diff --git a/.coderabbit.yaml b/.coderabbit.yaml
new file mode 100644
index 000000000..2408084cf
--- /dev/null
+++ b/.coderabbit.yaml
@@ -0,0 +1,6 @@
+# yaml-language-server: $schema=https://coderabbit.ai/integrations/schema.v2.json
+reviews:
+  auto_review:
+    # Dependabot bumps are checked by CI; skip CodeRabbit reviews on them.
+    ignore_usernames:
+      - "dependabot[bot]"
diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 2c4b8cb1a..093325ba7 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -14,6 +14,17 @@ updates:
           - "*"
     commit-message:
       prefix: "chore(deps)"
+    # craft-ui is still on egui 0.36, and two eguis in the graph don't build (#1990). Remove this
+    # once craft-ui moves to egui 0.37 (storytold/craft-libs#199).
+    ignore:
+      - dependency-name: "egui"
+        versions: [">=0.37"]
+      - dependency-name: "eframe"
+        versions: [">=0.37"]
+      - dependency-name: "egui-wgpu"
+        versions: [">=0.37"]
+      - dependency-name: "egui_kittest"
+        versions: [">=0.37"]
 
   # Maintain GitHub Actions workflows
   - package-ecosystem: "github-actions"
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
new file mode 100644
index 000000000..64c13bb23
--- /dev/null
+++ b/.github/workflows/ci.yml
@@ -0,0 +1,30 @@
+name: CI
+
+# Quality gates for every push to main and every pull request (`cargo xtask ci`), through the
+# suite's shared gate workflow in craft-common-actions.
+on:
+  push:
+    branches: [main]
+  pull_request:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+# A newer push to a PR branch cancels its older run; every push to main runs to the end.
+concurrency:
+  group: ci-${{ github.event_name == 'pull_request' && github.ref || github.run_id }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
+jobs:
+  gate:
+    # Tracks @main so suite-wide CI fixes reach every app without a PR in each repository.
+    uses: storytold/craft-common-actions/.github/workflows/gate.yml@main
+    with:
+      # Same craft-fonts commit as release.yml.
+      craft-fonts-ref: 3d9ab3a132ed0eff457e424226a435a901da30d3
+      timeout-minutes: 90
+      packages: >-
+        pkg-config libxkbcommon-dev libwayland-dev libx11-dev libxcb1-dev libxcursor-dev
+        libxrandr-dev libxi-dev libfontconfig1-dev libfreetype-dev mesa-vulkan-drivers
+        libgl1-mesa-dev
diff --git a/.github/workflows/freebsd.yml b/.github/workflows/freebsd.yml
index e7a607181..11d44fca4 100644
--- a/.github/workflows/freebsd.yml
+++ b/.github/workflows/freebsd.yml
@@ -2,6 +2,9 @@
 # (GitHub has no FreeBSD runners). GPU tests skip themselves when the VM has no adapter.
 name: FreeBSD
 
+# The VM build is slow, so it runs nightly on main and on pushes to `release`, not on every pull
+# request: a drifted dependency still shows up within a day, and always before a release ships.
+# PRs that change the FreeBSD workflow or packaging itself still run it.
 on:
   push:
     branches: [release]
diff --git a/.github/workflows/nix.yml b/.github/workflows/nix.yml
index 18392587a..318f6bba3 100644
--- a/.github/workflows/nix.yml
+++ b/.github/workflows/nix.yml
@@ -18,16 +18,44 @@ concurrency:
   cancel-in-progress: true
 
 jobs:
-  eval:
+  nix:
+    # Intentionally tracked at @main (not SHA-pinned) so org-wide CI improvements, security fixes, and build optimizations propagate without PR churn across all craftapp repos.
+    uses: storytold/craft-common-actions/.github/workflows/nix.yml@main
+
+  git-sources:
+    name: Git dependencies come from storytold
     runs-on: ubuntu-latest
-    timeout-minutes: 15
+    timeout-minutes: 5
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - uses: cachix/install-nix-action@13d8dd58da0234aa297dedd986986ccb8e7f3e24 # v31.11.1
-      - name: nix flake check --no-build
+      - name: Git dependencies come from storytold
         run: |
-          if [ -f flake.nix ]; then
-            nix flake check --no-build --all-systems
-          else
-            echo "No flake.nix present in this repository; skipping check."
-          fi
+          set -euo pipefail
+          test -f Cargo.lock || { echo "Cargo.lock is missing"; exit 1; }
+          # Source replacement, patches and path overrides in cargo config never show up
+          # in Cargo.lock. Parsed rather than grepped: TOML has many spellings of one key.
+          # Cargo still reads the legacy .cargo/config.
+          python3 - <<'PY'
+          import os, sys, tomllib
+          for path in (".cargo/config", ".cargo/config.toml"):
+              if not os.path.exists(path):
+                  continue
+              config = tomllib.load(open(path, "rb"))
+              replaced = [name for name, source in config.get("source", {}).items()
+                          if isinstance(source, dict) and "replace-with" in source]
+              if replaced or "patch" in config or "paths" in config:
+                  print(f"{path} replaces, patches or overrides a source")
+                  sys.exit(1)
+          PY
+          # Fails when Cargo.lock is out of date with the manifests.
+          cargo metadata --locked --format-version 1 > /dev/null
+          python3 - <<'PY'
+          import sys, tomllib
+          lock = tomllib.load(open("Cargo.lock", "rb"))
+          bad = sorted({p["source"] for p in lock.get("package", [])
+                        if p.get("source", "").startswith("git+")
+                        and not p["source"].startswith("git+https://github.com/storytold/")})
+          if bad:
+              print("Git dependencies outside github.com/storytold:", *bad, sep="\n")
+              sys.exit(1)
+          PY
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 04206b9c8..6cc35e572 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -11,14 +11,57 @@ on:
         default: ""
 
 permissions:
-  contents: write
+  contents: read
 
 concurrency:
   group: release-${{ github.ref }}
   cancel-in-progress: false
 
 jobs:
+  git-sources:
+    name: Git dependencies come from storytold
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Git dependencies come from storytold
+        run: |
+          set -euo pipefail
+          test -f Cargo.lock || { echo "Cargo.lock is missing"; exit 1; }
+          # Source replacement, patches and path overrides in cargo config never show up
+          # in Cargo.lock. Parsed rather than grepped: TOML has many spellings of one key.
+          # Cargo still reads the legacy .cargo/config.
+          python3 - <<'PY'
+          import os, sys, tomllib
+          for path in (".cargo/config", ".cargo/config.toml"):
+              if not os.path.exists(path):
+                  continue
+              config = tomllib.load(open(path, "rb"))
+              replaced = [name for name, source in config.get("source", {}).items()
+                          if isinstance(source, dict) and "replace-with" in source]
+              if replaced or "patch" in config or "paths" in config:
+                  print(f"{path} replaces, patches or overrides a source")
+                  sys.exit(1)
+          PY
+          # Fails when Cargo.lock is out of date with the manifests.
+          cargo metadata --locked --format-version 1 > /dev/null
+          python3 - <<'PY'
+          import sys, tomllib
+          lock = tomllib.load(open("Cargo.lock", "rb"))
+          bad = sorted({p["source"] for p in lock.get("package", [])
+                        if p.get("source", "").startswith("git+")
+                        and not p["source"].startswith("git+https://github.com/storytold/")})
+          if bad:
+              print("Git dependencies outside github.com/storytold:", *bad, sep="\n")
+              sys.exit(1)
+          PY
+
   release:
+    needs: git-sources
+    permissions:
+      # The reusable release workflow tags and uploads the draft release.
+      contents: write
     # Intentionally tracked at @main (not SHA-pinned) so org-wide CI improvements, security fixes, and build optimizations propagate without PR churn across all craftapp repos.
     uses: storytold/craft-common-actions/.github/workflows/release.yml@main
     with:
diff --git a/.github/workflows/sonarcloud.yml b/.github/workflows/sonarcloud.yml
new file mode 100644
index 000000000..e78fe1ea3
--- /dev/null
+++ b/.github/workflows/sonarcloud.yml
@@ -0,0 +1,21 @@
+name: SonarCloud
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    types: [opened, synchronize, reopened]
+
+permissions:
+  contents: read
+
+concurrency:
+  group: sonarcloud-${{ github.ref }}
+  # A push to main is the run that publishes coverage; superseded runs there would never finish.
+  cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}
+
+jobs:
+  sonarcloud:
+    # Tracked at @main so org-wide CI improvements propagate without PR churn.
+    uses: storytold/craft-common-actions/.github/workflows/sonarcloud.yml@main
+    secrets: inherit
diff --git a/.github/workflows/windows-arm64.yml b/.github/workflows/windows-arm64.yml
index 86c724a69..f7bb0996e 100644
--- a/.github/workflows/windows-arm64.yml
+++ b/.github/workflows/windows-arm64.yml
@@ -3,15 +3,17 @@
 # binaries are ARM64, run the CLI natively, and uninstall.
 name: Windows ARM64
 
+# Nightly on main and on pushes to `release` (dependency and runner-image drift shows up within a
+# day, and always before a release ships), and on PRs that change the Windows packaging itself.
 on:
+  schedule:
+    - cron: "3 5 * * *"
   push:
     branches: [release]
   pull_request:
     paths:
       - .github/workflows/windows-arm64.yml
       - packaging/windows/**
-  schedule:
-    - cron: "41 3 * * 1"
   workflow_dispatch:
 
 concurrency:
diff --git a/AGENTS.md b/AGENTS.md
index a8d4badc0..cd6de23e3 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -30,6 +30,7 @@ People trust CADCraft with their drawings; a crash loses their work. **This outr
 - **Programmatic calls never open dialogs.** `engine.execute` runs the JSON form with defaults; only menu/toolbar invocation starts the interactive prompt sequence.
 - **Layering** is enforced by `cargo xtask layers`: L0 `geom`, `dxf` → L1 `color`, `doc` → L2 `fonts`, `render`, `constraints` → L3 `io` → L4 `engine` → L5 `ui-egui`, `mcp` → apps. Nothing below L5 depends on egui/eframe/winit/wgpu/rfd. **The UI crate is swappable.**
 - **The UI is thin**: panels read engine state and act through `app.run(id, params)` / `app.start(id)` / `app.cmdline(text)`. Colours come from `theme::Tokens`.
+- **Time goes through `chrono`** (workspace dependency). Never hand-roll UTC/calendar conversion (days-to-date algorithms, leap-year math); a crate owns only its output format string. The one exception is range extension: past the years chrono can represent, shift the date by whole 400-year Gregorian cycles (146,097 days, after which the calendar repeats), let chrono compute the month and day, and add the cycles back to the year (splitting seconds into hours, minutes and seconds is plain arithmetic).
 - **Rust only** (no handwritten JS/TS). **Never break wasm** (`cargo xtask wasm`).
 - **Quality gates** before every commit: `cargo xtask ci` (fmt, clippy -D warnings, tests, assets, layers, wasm). Commit after every feature arc that builds, and push to `main`.
 
diff --git a/Cargo.lock b/Cargo.lock
index 3eb9cacc3..e5076e82e 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -4,9 +4,9 @@ version = 4
 
 [[package]]
 name = "acadrust"
-version = "0.6.4"
+version = "0.6.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "94862189cab6e282ed0433a801a216cd1a712953813284a48fa81c67223e38f6"
+checksum = "5eaa72520f70eb6f7f09b06f44e1ed0d8fad5fa743364f2c3715c30df962ec7c"
 dependencies = [
  "anyhow",
  "bitflags 2.13.2",
@@ -209,9 +209,9 @@ checksum = "330a5ed07fa54e4702c9d6c4174f74427fc0ef6e214bbd677ae50a5099946470"
 
 [[package]]
 name = "arboard"
-version = "3.6.1"
+version = "3.7.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0348a1c054491f4bfe6ab86a7b6ab1e44e45d899005de92f58b3df180b36ddaf"
+checksum = "aeb9553e62312c8756a5979254fc6d7da8bbeb5986a1e17037fab932f7037917"
 dependencies = [
  "clipboard-win",
  "image",
@@ -223,7 +223,7 @@ dependencies = [
  "objc2-foundation 0.3.2",
  "parking_lot",
  "percent-encoding",
- "windows-sys 0.60.2",
+ "windows-sys 0.61.2",
  "x11rb",
 ]
 
@@ -547,11 +547,13 @@ checksum = "fc652a48c352aef3ea3aed32080501cf3ef6ed5da78602a020c991775b0aff04"
 
 [[package]]
 name = "cadcraft"
-version = "0.9.0"
+version = "0.12.0"
 dependencies = [
  "cadcraft-engine",
  "cadcraft-io",
+ "cadcraft-mcp",
  "cadcraft-ui-egui",
+ "chrono",
  "eframe",
  "egui",
  "hidapi",
@@ -569,7 +571,7 @@ dependencies = [
 
 [[package]]
 name = "cadcraft-cli"
-version = "0.9.0"
+version = "0.12.0"
 dependencies = [
  "cadcraft-engine",
  "cadcraft-io",
@@ -580,14 +582,14 @@ dependencies = [
 
 [[package]]
 name = "cadcraft-color"
-version = "0.9.0"
+version = "0.12.0"
 dependencies = [
  "serde",
 ]
 
 [[package]]
 name = "cadcraft-constraints"
-version = "0.9.0"
+version = "0.12.0"
 dependencies = [
  "cadcraft-doc",
  "cadcraft-geom",
@@ -597,7 +599,7 @@ dependencies = [
 
 [[package]]
 name = "cadcraft-doc"
-version = "0.9.0"
+version = "0.12.0"
 dependencies = [
  "cadcraft-color",
  "cadcraft-geom",
@@ -608,14 +610,14 @@ dependencies = [
 
 [[package]]
 name = "cadcraft-dwg"
-version = "0.9.0"
+version = "0.12.0"
 dependencies = [
  "acadrust",
 ]
 
 [[package]]
 name = "cadcraft-dxf"
-version = "0.9.0"
+version = "0.12.0"
 dependencies = [
  "encoding_rs",
  "log",
@@ -624,7 +626,7 @@ dependencies = [
 
 [[package]]
 name = "cadcraft-engine"
-version = "0.9.0"
+version = "0.12.0"
 dependencies = [
  "cadcraft-color",
  "cadcraft-constraints",
@@ -635,6 +637,7 @@ dependencies = [
  "cadcraft-io",
  "cadcraft-render",
  "craft-docpath",
+ "libc",
  "log",
  "rstar",
  "serde",
@@ -644,24 +647,24 @@ dependencies = [
 
 [[package]]
 name = "cadcraft-fonts"
-version = "0.9.0"
+version = "0.12.0"
 dependencies = [
  "cadcraft-geom",
- "harfrust",
- "skrifa 0.47.0",
+ "harfrust 0.14.0",
+ "skrifa 0.48.0",
  "unicode-bidi",
 ]
 
 [[package]]
 name = "cadcraft-geom"
-version = "0.9.0"
+version = "0.12.0"
 dependencies = [
  "serde",
 ]
 
 [[package]]
 name = "cadcraft-io"
-version = "0.9.0"
+version = "0.12.0"
 dependencies = [
  "acadrust",
  "cadcraft-color",
@@ -671,8 +674,8 @@ dependencies = [
  "cadcraft-fonts",
  "cadcraft-geom",
  "cadcraft-render",
- "miniz_oxide 0.8.9",
- "quick-xml",
+ "miniz_oxide 0.9.1",
+ "quick-xml 0.42.0",
  "serde",
  "serde_json",
  "thiserror 2.0.21",
@@ -681,18 +684,19 @@ dependencies = [
 
 [[package]]
 name = "cadcraft-mcp"
-version = "0.9.0"
+version = "0.12.0"
 dependencies = [
  "cadcraft-engine",
  "cadcraft-io",
  "cadcraft-render",
+ "getrandom 0.4.3",
  "log",
  "serde_json",
 ]
 
 [[package]]
 name = "cadcraft-render"
-version = "0.9.0"
+version = "0.12.0"
 dependencies = [
  "cadcraft-color",
  "cadcraft-doc",
@@ -706,7 +710,7 @@ dependencies = [
 
 [[package]]
 name = "cadcraft-ui-egui"
-version = "0.9.0"
+version = "0.12.0"
 dependencies = [
  "cadcraft-color",
  "cadcraft-doc",
@@ -714,6 +718,7 @@ dependencies = [
  "cadcraft-fonts",
  "cadcraft-geom",
  "cadcraft-render",
+ "chrono",
  "craft-ui",
  "egui",
  "egui-wgpu",
@@ -728,7 +733,7 @@ dependencies = [
 
 [[package]]
 name = "cadcraft-web"
-version = "0.9.0"
+version = "0.12.0"
 dependencies = [
  "cadcraft-engine",
  "cadcraft-io",
@@ -825,6 +830,15 @@ dependencies = [
  "libc",
 ]
 
+[[package]]
+name = "chrono"
+version = "0.4.45"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1aa79e62e7697b8e29b513a68abacf485adcd1fe8284a4316c5ae868e6633327"
+dependencies = [
+ "num-traits",
+]
+
 [[package]]
 name = "clipboard-win"
 version = "5.4.1"
@@ -1298,7 +1312,7 @@ dependencies = [
  "emath",
  "epaint_default_fonts",
  "font-types",
- "harfrust",
+ "harfrust 0.12.0",
  "log",
  "nohash-hasher",
  "parking_lot",
@@ -1427,9 +1441,9 @@ checksum = "77ce24cb58228fbb8aa041425bb1050850ac19177686ea6e0f41a70416f56fdb"
 
 [[package]]
 name = "font-types"
-version = "0.12.6"
+version = "0.12.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6c92d9081c7ab3bd83ef1eecdfad090f3d966e3ce74106779664114cfe1a6274"
+checksum = "835ae9d781464a79026cde387f9cbc650c9a4909d7cf7e658b127e3c35d2f35d"
 dependencies = [
  "bytemuck",
  "serde",
@@ -1720,6 +1734,18 @@ dependencies = [
  "smallvec",
 ]
 
+[[package]]
+name = "harfrust"
+version = "0.14.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "86aa776d6d32b072119e1f1650f4db843ff4382a4aaa6a2c9c4e35703cd377cb"
+dependencies = [
+ "bitflags 2.13.2",
+ "bytemuck",
+ "read-fonts 0.45.1",
+ "smallvec",
+]
+
 [[package]]
 name = "hash32"
 version = "0.3.1"
@@ -1900,7 +1926,7 @@ dependencies = [
  "byteorder-lite",
  "moxcms",
  "num-traits",
- "png 0.18.1",
+ "png",
  "tiff",
  "zune-core",
  "zune-jpeg",
@@ -2086,9 +2112,9 @@ checksum = "20870f649af7073d53e38067b2a84312175d56ea15217e1b15bc83506ec50afb"
 
 [[package]]
 name = "libc"
-version = "0.2.190"
+version = "0.2.191"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ce5d3ddc6d3fa000eb1536d85e147bfe31aacaba692ed6a876f95cb7c855be78"
+checksum = "65cd87c9a6d60536580b316ad985726104730a5151c99845f2490428ef91240a"
 
 [[package]]
 name = "libloading"
@@ -2257,9 +2283,9 @@ dependencies = [
 
 [[package]]
 name = "muda"
-version = "0.21.0"
+version = "0.21.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c6744ab645ebe79f9c428455c7cb9dfa4275fa3b50a25408e08f927da8dc618c"
+checksum = "4340e89c178916e62879c5c36b7f699019369be413e496178a6983ce91b8bc03"
 dependencies = [
  "crossbeam-channel",
  "dpi",
@@ -2268,8 +2294,7 @@ dependencies = [
  "objc2-app-kit 0.3.2",
  "objc2-core-foundation",
  "objc2-foundation 0.3.2",
- "once_cell",
- "png 0.18.1",
+ "png",
  "thiserror 2.0.21",
  "windows-sys 0.61.2",
 ]
@@ -2931,19 +2956,6 @@ version = "0.2.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b4596b6d070b27117e987119b4dac604f3c58cfb0b191112e24771b2faeac1a6"
 
-[[package]]
-name = "png"
-version = "0.17.16"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "82151a2fc869e011c153adc57cf2789ccb8d9906ce52c0b39a6b5697749d7526"
-dependencies = [
- "bitflags 1.3.2",
- "crc32fast",
- "fdeflate",
- "flate2",
- "miniz_oxide 0.8.9",
-]
-
 [[package]]
 name = "png"
 version = "0.18.1"
@@ -3067,6 +3079,15 @@ dependencies = [
  "memchr",
 ]
 
+[[package]]
+name = "quick-xml"
+version = "0.42.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "41b1177fdf999d2321d3fb46ff47159d9c1fb9ad66a4879f8c50a0b504615e9b"
+dependencies = [
+ "memchr",
+]
+
 [[package]]
 name = "quote"
 version = "1.0.47"
@@ -3145,13 +3166,15 @@ dependencies = [
 
 [[package]]
 name = "read-fonts"
-version = "0.44.0"
+version = "0.45.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d5a0cf4bb6cbce4c29756270d189a5e400ac05e91192161d83a0bcb6e68492e8"
+checksum = "4edc8db0d972de88e53a085b1f01fb3fbdae7bb0cb7a0ce2b2f8285a412fe3ef"
 dependencies = [
  "bytemuck",
+ "foldhash",
  "font-types",
  "once_cell",
+ "yoke",
 ]
 
 [[package]]
@@ -3230,9 +3253,9 @@ dependencies = [
 
 [[package]]
 name = "rstar"
-version = "0.12.2"
+version = "0.13.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "421400d13ccfd26dfa5858199c30a5d76f9c54e0dba7575273025b43c5175dbb"
+checksum = "5912b862fa5ffb462607bfd1e35036c458c537921f508c8235a83d5f3987edfe"
 dependencies = [
  "heapless",
  "num-traits",
@@ -3363,9 +3386,9 @@ dependencies = [
 
 [[package]]
 name = "serde_json"
-version = "1.0.151"
+version = "1.0.154"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c841b55ecdae098c80dcae9cf767f6f8a0c2cdb3416bbef72181df4d0fe73f14"
+checksum = "e7e9cc8b1b85264074fbcc02a88680c4096b1e47df8f739dceb03bf482f04bd6"
 dependencies = [
  "itoa",
  "memchr",
@@ -3450,12 +3473,12 @@ dependencies = [
 
 [[package]]
 name = "skrifa"
-version = "0.47.0"
+version = "0.48.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "526e654b303ff4ad73a5a40b25de2b3ce3d039c5e3b6da5f89ae6e57004cb40f"
+checksum = "a5213b4825bac3587046330052d61bfac7bd3bd0d203c758d7c2ef726fcea034"
 dependencies = [
  "bytemuck",
- "read-fonts 0.44.0",
+ "read-fonts 0.45.1",
 ]
 
 [[package]]
@@ -3701,24 +3724,24 @@ dependencies = [
 
 [[package]]
 name = "tiny-skia"
-version = "0.11.4"
+version = "0.12.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "83d13394d44dae3207b52a326c0c85a8bf87f1541f23b0d143811088497b09ab"
+checksum = "47ffee5eaaf5527f630fb0e356b90ebdec84d5d18d937c5e440350f88c5a91ea"
 dependencies = [
  "arrayref",
  "arrayvec",
  "bytemuck",
  "cfg-if",
  "log",
- "png 0.17.16",
+ "png",
  "tiny-skia-path",
 ]
 
 [[package]]
 name = "tiny-skia-path"
-version = "0.11.4"
+version = "0.12.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9c9e7fc0c2e86a30b117d0462aa261b72b7a99b7ebd7deb3a14ceda95c5bdc93"
+checksum = "edca365c3faccca67d06593c5980fa6c57687de727a03131735bb85f01fdeeb9"
 dependencies = [
  "arrayref",
  "bytemuck",
@@ -4139,7 +4162,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "338e30461b3a2b67d70eb30a6d89f8e0c93a833e07d2ae89085cd070c4a00ac0"
 dependencies = [
  "proc-macro2",
- "quick-xml",
+ "quick-xml 0.41.0",
  "quote",
 ]
 
@@ -4496,7 +4519,7 @@ version = "0.52.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "282be5f36a8ce781fad8c8ae18fa3f9beff57ec1b52cb3de0789201425d9a33d"
 dependencies = [
- "windows-targets 0.52.6",
+ "windows-targets",
 ]
 
 [[package]]
@@ -4505,16 +4528,7 @@ version = "0.59.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1e38bc4d79ed67fd075bcc251a1c39b32a1776bbe92e5bef1f0bf1f8c531853b"
 dependencies = [
- "windows-targets 0.52.6",
-]
-
-[[package]]
-name = "windows-sys"
-version = "0.60.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f2f500e4d28234f72040990ec9d39e3a6b950f9f22d3dba18416c35882612bcb"
-dependencies = [
- "windows-targets 0.53.5",
+ "windows-targets",
 ]
 
 [[package]]
@@ -4532,31 +4546,14 @@ version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9b724f72796e036ab90c1021d4780d4d3d648aca59e491e6b98e725b84e99973"
 dependencies = [
- "windows_aarch64_gnullvm 0.52.6",
- "windows_aarch64_msvc 0.52.6",
- "windows_i686_gnu 0.52.6",
- "windows_i686_gnullvm 0.52.6",
- "windows_i686_msvc 0.52.6",
- "windows_x86_64_gnu 0.52.6",
- "windows_x86_64_gnullvm 0.52.6",
- "windows_x86_64_msvc 0.52.6",
-]
-
-[[package]]
-name = "windows-targets"
-version = "0.53.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4945f9f551b88e0d65f3db0bc25c33b8acea4d9e41163edf90dcd0b19f9069f3"
-dependencies = [
- "windows-link",
- "windows_aarch64_gnullvm 0.53.1",
- "windows_aarch64_msvc 0.53.1",
- "windows_i686_gnu 0.53.1",
- "windows_i686_gnullvm 0.53.1",
- "windows_i686_msvc 0.53.1",
- "windows_x86_64_gnu 0.53.1",
- "windows_x86_64_gnullvm 0.53.1",
- "windows_x86_64_msvc 0.53.1",
+ "windows_aarch64_gnullvm",
+ "windows_aarch64_msvc",
+ "windows_i686_gnu",
+ "windows_i686_gnullvm",
+ "windows_i686_msvc",
+ "windows_x86_64_gnu",
+ "windows_x86_64_gnullvm",
+ "windows_x86_64_msvc",
 ]
 
 [[package]]
@@ -4574,96 +4571,48 @@ version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "32a4622180e7a0ec044bb555404c800bc9fd9ec262ec147edd5989ccd0c02cd3"
 
-[[package]]
-name = "windows_aarch64_gnullvm"
-version = "0.53.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a9d8416fa8b42f5c947f8482c43e7d89e73a173cead56d044f6a56104a6d1b53"
-
 [[package]]
 name = "windows_aarch64_msvc"
 version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "09ec2a7bb152e2252b53fa7803150007879548bc709c039df7627cabbd05d469"
 
-[[package]]
-name = "windows_aarch64_msvc"
-version = "0.53.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b9d782e804c2f632e395708e99a94275910eb9100b2114651e04744e9b125006"
-
 [[package]]
 name = "windows_i686_gnu"
 version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8e9b5ad5ab802e97eb8e295ac6720e509ee4c243f69d781394014ebfe8bbfa0b"
 
-[[package]]
-name = "windows_i686_gnu"
-version = "0.53.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "960e6da069d81e09becb0ca57a65220ddff016ff2d6af6a223cf372a506593a3"
-
 [[package]]
 name = "windows_i686_gnullvm"
 version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0eee52d38c090b3caa76c563b86c3a4bd71ef1a819287c19d586d7334ae8ed66"
 
-[[package]]
-name = "windows_i686_gnullvm"
-version = "0.53.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fa7359d10048f68ab8b09fa71c3daccfb0e9b559aed648a8f95469c27057180c"
-
 [[package]]
 name = "windows_i686_msvc"
 version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "240948bc05c5e7c6dabba28bf89d89ffce3e303022809e73deaefe4f6ec56c66"
 
-[[package]]
-name = "windows_i686_msvc"
-version = "0.53.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1e7ac75179f18232fe9c285163565a57ef8d3c89254a30685b57d83a38d326c2"
-
 [[package]]
 name = "windows_x86_64_gnu"
 version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "147a5c80aabfbf0c7d901cb5895d1de30ef2907eb21fbbab29ca94c5b08b1a78"
 
-[[package]]
-name = "windows_x86_64_gnu"
-version = "0.53.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9c3842cdd74a865a8066ab39c8a7a473c0778a3f29370b5fd6b4b9aa7df4a499"
-
 [[package]]
 name = "windows_x86_64_gnullvm"
 version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "24d5b23dc417412679681396f2b49f3de8c1473deb516bd34410872eff51ed0d"
 
-[[package]]
-name = "windows_x86_64_gnullvm"
-version = "0.53.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0ffa179e2d07eee8ad8f57493436566c7cc30ac536a3379fdf008f47f6bb7ae1"
-
 [[package]]
 name = "windows_x86_64_msvc"
 version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "589f6da84c646204747d1270a2a5661ea66ed1cced2631d546fdfb155959f9ec"
 
-[[package]]
-name = "windows_x86_64_msvc"
-version = "0.53.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d6bbff5f0aada427a1e5a6da5f1f98158182f26556f345ac9e04d36d0ebed650"
-
 [[package]]
 name = "winit"
 version = "0.30.13"
@@ -4726,9 +4675,9 @@ dependencies = [
 
 [[package]]
 name = "winresource"
-version = "0.1.31"
+version = "0.1.34"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0986a8b1d586b7d3e4fe3d9ea39fb451ae22869dcea4aa109d287a374d866087"
+checksum = "a2bc6d36480b829272a5bdabf08e6dca8004761c1da7e35efef800540c66221b"
 dependencies = [
  "toml",
  "version_check",
@@ -4811,8 +4760,9 @@ checksum = "e450f9b2ed1dff33c94c12589a87338689467b9c4f5d8a5710bd09a847d2c8a7"
 
 [[package]]
 name = "xtask"
-version = "0.9.0"
+version = "0.12.0"
 dependencies = [
+ "chrono",
  "serde_json",
 ]
 
diff --git a/Cargo.toml b/Cargo.toml
index ccf8b9d70..6e1afaa06 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -4,7 +4,7 @@ members = ["crates/*", "apps/*", "xtask"]
 # default-members
 
 [workspace.package]
-version = "0.9.0"
+version = "0.12.0"
 edition = "2024"
 license = "MIT OR Apache-2.0"
 rust-version = "1.90"
@@ -32,20 +32,22 @@ thiserror = "2"
 serde = { version = "1", features = ["derive", "rc"] }
 serde_json = { version = "1", features = ["float_roundtrip"] }
 log = "0.4"
+# All date/time conversion goes through chrono (no hand-rolled calendar code beyond the 400-year range extension; AGENTS.md).
+chrono = { version = "0.4.45", default-features = false, features = ["std"] }
 rayon = "1"
 
 # rendering / formats
-tiny-skia = { version = "0.11", default-features = false, features = ["std", "simd", "png-format"] }
+tiny-skia = { version = "0.12", default-features = false, features = ["std", "simd", "png-format"] }
 lyon_tessellation = "1.0.22"
-skrifa = "0.47"
-# Text shaping (OpenType GSUB/GPOS, HarfBuzz port on read-fonts; the version egui's epaint uses)
-# and the Unicode Bidirectional Algorithm for right-to-left drawing text.
-harfrust = "0.12"
+skrifa = "0.48"
+# Text shaping (OpenType GSUB/GPOS, HarfBuzz port on read-fonts; egui's epaint is still on 0.12,
+# so the graph has both) and the Unicode Bidirectional Algorithm for right-to-left drawing text.
+harfrust = "0.14"
 unicode-bidi = "0.3.18"
 image = { version = "0.25", default-features = false, features = ["png", "jpeg"] }
 encoding_rs = "0.8.35"
 # XML for the SVG reader (streaming parser, no entity expansion beyond the five predefined ones)
-quick-xml = "0.41"
+quick-xml = "0.42"
 
 # ui
 craft-ui = { version = "0.1.0", git = "https://github.com/storytold/craft-libs", rev = "5c874d51eeb3de70e735c8ce87a59a7dedd47675", features = ["serde"] }
@@ -67,9 +69,11 @@ type_complexity = "allow"
 
 [profile.dev.package."*"]
 opt-level = 2
+debug = false
 
 [profile.dev]
 opt-level = 1
+debug = "line-tables-only"
 
 [profile.release]
 opt-level = 3
diff --git a/README.md b/README.md
index 4bf49072c..655b944f5 100644
--- a/README.md
+++ b/README.md
@@ -7,6 +7,10 @@
   </a>
 </p>
 
+<p align="center">
+  <img src="assets/app-icon/hicolor/256x256/apps/ai.storyteller.cadcraft.png" width="128" height="128" alt="CADCraft icon: a drafting set square and compass arc on a blue grid tile">
+</p>
+
 <h1 align="center">CADCraft</h1>
 
 <p align="center">
@@ -26,6 +30,9 @@
   <img alt="License: MIT OR Apache-2.0" src="https://img.shields.io/badge/license-MIT%20%2F%20Apache--2.0-0b6f88?style=flat-square">
   <img alt="Agent-drivable over MCP" src="https://img.shields.io/badge/agents-MCP-14a3c7?style=flat-square">
   <img alt="Status: early development" src="https://img.shields.io/badge/status-early%20development-f07a3a?style=flat-square">
+  <br>
+  <a href="https://sonarcloud.io/project/overview?id=storytold_cadcraft"><img alt="Scanned by SonarCloud" src="https://img.shields.io/badge/Scanned_by-SonarCloud-4b9fd5?style=flat-square&logo=sonarqubecloud&logoColor=white"></a>
+  <a href="https://coderabbit.ai"><img alt="Reviewed by CodeRabbit" src="https://img.shields.io/coderabbit/prs/github/storytold/cadcraft?style=flat-square&label=Reviewed%20by%20CodeRabbit&logo=coderabbit"></a>
 </p>
 
 <p align="center">
@@ -282,6 +289,14 @@ See [ROADMAP.md](ROADMAP.md) for the stage, measured parity and the estimate of
 
 **Download CADCraft** from GitHub: the [latest release](https://github.com/storytold/cadcraft/releases/latest) has every build listed below, and [all releases](https://github.com/storytold/cadcraft/releases) has earlier versions and their notes. `<ver>` in the file names is the version number, and `SHA256SUMS.txt` lists a checksum for every file.
 
+> [!WARNING]
+> Download official CADCraft builds from the [storytold/cadcraft releases](https://github.com/storytold/cadcraft/releases). Verify that the repository owner is `storytold`. Before you run a download, check that its checksum matches the line for that file in the release's `SHA256SUMS.txt`:
+>
+> ```sh
+> shasum -a 256 cadcraft-<ver>-macos-universal.dmg     # macOS (on Linux: sha256sum FILE)
+> Get-FileHash .\cadcraft-<ver>-windows-x64.msi        # Windows PowerShell
+> ```
+
 ### Windows
 
 | Build | Installer | Portable |
diff --git a/apps/cadcraft-cli/tests/cli.rs b/apps/cadcraft-cli/tests/it/cli.rs
similarity index 100%
rename from apps/cadcraft-cli/tests/cli.rs
rename to apps/cadcraft-cli/tests/it/cli.rs
diff --git a/apps/cadcraft-cli/tests/drafting_spacing.rs b/apps/cadcraft-cli/tests/it/drafting_spacing.rs
similarity index 100%
rename from apps/cadcraft-cli/tests/drafting_spacing.rs
rename to apps/cadcraft-cli/tests/it/drafting_spacing.rs
diff --git a/apps/cadcraft-cli/tests/help.rs b/apps/cadcraft-cli/tests/it/help.rs
similarity index 100%
rename from apps/cadcraft-cli/tests/help.rs
rename to apps/cadcraft-cli/tests/it/help.rs
diff --git a/apps/cadcraft-cli/tests/it/main.rs b/apps/cadcraft-cli/tests/it/main.rs
new file mode 100644
index 000000000..efd49c7dd
--- /dev/null
+++ b/apps/cadcraft-cli/tests/it/main.rs
@@ -0,0 +1,6 @@
+mod cli;
+mod drafting_spacing;
+mod help;
+mod mcp_connect;
+mod skipped_records;
+mod undrawn_entities;
diff --git a/apps/cadcraft-cli/tests/mcp_connect.rs b/apps/cadcraft-cli/tests/it/mcp_connect.rs
similarity index 100%
rename from apps/cadcraft-cli/tests/mcp_connect.rs
rename to apps/cadcraft-cli/tests/it/mcp_connect.rs
diff --git a/apps/cadcraft-cli/tests/skipped_records.rs b/apps/cadcraft-cli/tests/it/skipped_records.rs
similarity index 100%
rename from apps/cadcraft-cli/tests/skipped_records.rs
rename to apps/cadcraft-cli/tests/it/skipped_records.rs
diff --git a/apps/cadcraft-cli/tests/undrawn_entities.rs b/apps/cadcraft-cli/tests/it/undrawn_entities.rs
similarity index 100%
rename from apps/cadcraft-cli/tests/undrawn_entities.rs
rename to apps/cadcraft-cli/tests/it/undrawn_entities.rs
diff --git a/apps/cadcraft-web/index.html b/apps/cadcraft-web/index.html
index c8e2e9603..6cd4ab971 100644
--- a/apps/cadcraft-web/index.html
+++ b/apps/cadcraft-web/index.html
@@ -2,7 +2,7 @@
 <html lang="en">
 <head>
   <meta charset="utf-8">
-  <meta name="viewport" content="width=device-width, initial-scale=1, user-scalable=no">
+  <meta name="viewport" content="width=device-width, initial-scale=1">
   <title>CADCraft</title>
   <link data-trunk rel="rust" data-bin="cadcraft-web" data-wasm-opt="z" data-weak-refs />
   <style>
diff --git a/apps/cadcraft/Cargo.toml b/apps/cadcraft/Cargo.toml
index ec527437d..7a46fa9bc 100644
--- a/apps/cadcraft/Cargo.toml
+++ b/apps/cadcraft/Cargo.toml
@@ -14,10 +14,13 @@ workspace = true
 cadcraft-engine = { workspace = true }
 cadcraft-ui-egui = { workspace = true }
 cadcraft-io = { workspace = true }
+# For the shared per-session control-token helper (control_server.rs authentication).
+cadcraft-mcp = { workspace = true }
 eframe = { workspace = true, features = ["default_fonts", "wgpu", "accesskit", "wayland", "x11", "links", "persistence"] }
 egui = { workspace = true }
 serde_json = { workspace = true }
 log = { workspace = true }
+chrono = { workspace = true }
 
 [build-dependencies]
 winresource = "0.1"
diff --git a/apps/cadcraft/src/control_server.rs b/apps/cadcraft/src/control_server.rs
index 4433d76e5..14283e6fd 100644
--- a/apps/cadcraft/src/control_server.rs
+++ b/apps/cadcraft/src/control_server.rs
@@ -48,11 +48,26 @@ impl Default for Limits {
     }
 }
 
+/// Start the loopback server with a fresh session token and a bounded request queue.
+/// Binding or token-issuance failure returns a disconnected receiver.
 pub fn start(port: u16, ctx: egui::Context) -> Receiver<ControlRequest> {
     match TcpListener::bind(("127.0.0.1", port)) {
         Ok(l) => {
-            log::info!("control server listening on 127.0.0.1:{port}");
-            serve_listener(l, Limits::default(), ctx)
+            // Loopback TCP cannot tell local users apart, so issue an unguessable per-session
+            // token in an owner-only file and require it on every request (CWE-306). A client
+            // (the MCP bridge) reads it from the file, which needs the desktop user's filesystem
+            // access; another local account cannot.
+            let token = match cadcraft_mcp::control_token::issue(port) {
+                Ok(t) => Arc::new(t),
+                Err(e) => {
+                    log::error!("control server not started: could not write the control token: {e}");
+                    return sync_channel::<ControlRequest>(0).1;
+                }
+            };
+            if let Ok(path) = cadcraft_mcp::control_token::token_path(port) {
+                log::info!("control server listening on 127.0.0.1:{port} (token in {})", path.display());
+            }
+            serve_listener(l, Limits::default(), ctx, token)
         }
         Err(e) => {
             log::error!("control server failed to bind 127.0.0.1:{port}: {e}");
@@ -61,10 +76,20 @@ pub fn start(port: u16, ctx: egui::Context) -> Receiver<ControlRequest> {
     }
 }
 
+/// How long the accepting thread waits after a failed accept. Accepting can keep failing, for
+/// example while the process has no file descriptors left, and retrying at once would keep a
+/// core busy until it recovers.
+const ACCEPT_RETRY: Duration = Duration::from_millis(100);
+
+/// The connections `incoming` accepts, calling `wait` after each failed accept.
+fn accepted<T>(incoming: impl Iterator<Item = std::io::Result<T>>, mut wait: impl FnMut()) -> impl Iterator<Item = T> {
+    incoming.filter_map(move |stream| stream.map_err(|_| wait()).ok())
+}
+
 /// Accept connections on `listener` under `limits`; requests arrive on the returned receiver.
-fn serve_listener(listener: TcpListener, limits: Limits, ctx: egui::Context) -> Receiver<ControlRequest> {
+fn serve_listener(listener: TcpListener, limits: Limits, ctx: egui::Context, token: Arc<String>) -> Receiver<ControlRequest> {
     let (tx, rx) = sync_channel::<ControlRequest>(limits.queue.max(1));
-    std::thread::spawn(move || accept_loop(listener, tx, ctx, limits));
+    std::thread::spawn(move || accept_loop(listener, tx, ctx, limits, token));
     rx
 }
 
@@ -78,9 +103,10 @@ impl Drop for Slot {
     }
 }
 
-fn accept_loop(listener: TcpListener, tx: SyncSender<ControlRequest>, ctx: egui::Context, limits: Limits) {
+/// Accept clients within the connection limit and give each worker the same session token.
+fn accept_loop(listener: TcpListener, tx: SyncSender<ControlRequest>, ctx: egui::Context, limits: Limits, token: Arc<String>) {
     let open = Arc::new(AtomicUsize::new(0));
-    for mut stream in listener.incoming().flatten() {
+    for mut stream in accepted(listener.incoming(), || std::thread::sleep(ACCEPT_RETRY)) {
         let _ = stream.set_write_timeout(Some(limits.write_timeout));
         if open.fetch_add(1, Ordering::SeqCst) >= limits.max_clients {
             open.fetch_sub(1, Ordering::SeqCst);
@@ -90,9 +116,10 @@ fn accept_loop(listener: TcpListener, tx: SyncSender<ControlRequest>, ctx: egui:
         let slot = Slot(Arc::clone(&open));
         let tx = tx.clone();
         let ctx = ctx.clone();
+        let token = Arc::clone(&token);
         let _ = std::thread::Builder::new().spawn(move || {
             let _slot = slot;
-            serve(stream, &tx, &ctx, limits);
+            serve(stream, &tx, &ctx, limits, &token);
         });
     }
 }
@@ -131,12 +158,14 @@ enum Line {
         id: Value,
         method: String,
         params: Value,
+        token: Option<String>,
     },
     Blank,
     /// Not a request: reply with this error and close the connection.
     Reject(String),
 }
 
+/// Parse a UTF-8 JSON request and its optional token, distinguishing blank lines from rejected input.
 fn parse_line(bytes: &[u8]) -> Line {
     let Ok(text) = std::str::from_utf8(bytes) else {
         return Line::Reject("not a control request (invalid UTF-8); closing the connection".into());
@@ -162,6 +191,7 @@ fn parse_line(bytes: &[u8]) -> Line {
         id: obj.get("id").cloned().unwrap_or(Value::Null),
         method: method.to_string(),
         params: obj.get("params").cloned().unwrap_or(json!({})),
+        token: obj.get("token").and_then(Value::as_str).map(str::to_string),
     }
 }
 
@@ -172,7 +202,9 @@ fn is_http_request_line(text: &str) -> bool {
         || text.rsplit_once(' ').is_some_and(|(_, version)| version.starts_with("HTTP/"))
 }
 
-fn serve(stream: TcpStream, tx: &SyncSender<ControlRequest>, ctx: &egui::Context, limits: Limits) {
+/// Serve bounded JSON lines, authenticating each request before enqueueing it for the UI.
+/// Invalid credentials close the connection; queue and reply limits report whether a request ran.
+fn serve(stream: TcpStream, tx: &SyncSender<ControlRequest>, ctx: &egui::Context, limits: Limits, token: &str) {
     if stream.set_read_timeout(Some(limits.idle_timeout)).is_err() || stream.set_write_timeout(Some(limits.write_timeout)).is_err() {
         return;
     }
@@ -190,7 +222,18 @@ fn serve(stream: TcpStream, tx: &SyncSender<ControlRequest>, ctx: &egui::Context
             Ok(true) => match parse_line(&buf) {
                 Line::Blank => continue,
                 Line::Reject(e) => e,
-                Line::Request { id, method, params } => {
+                Line::Request { id, method, params, token: given } => {
+                    // Authenticate the peer before dispatching: loopback TCP does not identify the
+                    // OS user, so only a client holding the owner-only session token may drive the
+                    // desktop user's commands (CWE-306).
+                    if !given.map(|g| cadcraft_mcp::control_token::matches(token, &g)).unwrap_or(false) {
+                        let mut r = json!({"ok": false, "error": "unauthorized: missing or invalid control token", "state": "not-run"});
+                        if let Some(o) = r.as_object_mut() {
+                            o.insert("id".into(), id);
+                        }
+                        let _ = writeln!(out, "{r}");
+                        break;
+                    }
                     let (req, pending) = ControlRequest::new(method, params);
                     let mut r = match tx.try_send(req) {
                         Ok(()) => {
@@ -222,6 +265,18 @@ fn serve(stream: TcpStream, tx: &SyncSender<ControlRequest>, ctx: &egui::Context
 mod tests {
     use super::*;
 
+    /// A failed accept is followed by a wait before the next one, so a listener that keeps
+    /// failing does not spin, and the connections around the failures still come through.
+    #[test]
+    fn a_failed_accept_waits_before_the_next() {
+        let failed = || Err(std::io::Error::other("no file descriptors left"));
+        let incoming = vec![failed(), Ok(1), failed(), failed(), Ok(2)];
+        let mut waits = 0;
+        let connections: Vec<i32> = super::accepted(incoming.into_iter(), || waits += 1).collect();
+        assert_eq!(connections, [1, 2]);
+        assert_eq!(waits, 3, "one wait per failed accept");
+    }
+
     #[test]
     fn lines_are_read_up_to_the_limit() {
         let mut buf = Vec::new();
@@ -255,11 +310,14 @@ mod tests {
         }
     }
 
+    /// A fixed token for tests; real tokens are random (see `cadcraft_mcp::control_token`).
+    const TEST_TOKEN: &str = "test-control-token";
+
     /// The control server on a loopback port under `limits`; requests arrive on the receiver.
     fn serve_with(limits: Limits) -> (std::net::SocketAddr, Receiver<ControlRequest>) {
         let listener = TcpListener::bind(("127.0.0.1", 0)).unwrap();
         let addr = listener.local_addr().unwrap();
-        (addr, serve_listener(listener, limits, egui::Context::default()))
+        (addr, serve_listener(listener, limits, egui::Context::default(), Arc::new(TEST_TOKEN.to_string())))
     }
 
     /// The control server on a loopback port, with a stand-in UI that echoes each method.
@@ -273,6 +331,11 @@ mod tests {
         addr
     }
 
+    /// A request line carrying the test token, so it authenticates.
+    fn req_line(id: i64, method: &str) -> String {
+        json!({"id": id, "method": method, "token": TEST_TOKEN}).to_string() + "\n"
+    }
+
     /// Send `input` on a new connection and read reply lines until the server closes it.
     fn exchange(addr: std::net::SocketAddr, input: &[u8]) -> Vec<Value> {
         let mut c = TcpStream::connect(addr).unwrap();
@@ -328,16 +391,17 @@ mod tests {
         assert!(t.elapsed() < Duration::from_secs(4));
     }
 
+    /// Authenticated requests rejected by a full queue retain their IDs and report that they did not run.
     #[test]
     fn a_full_queue_answers_busy() {
         let (addr, rx) = serve_with(short());
         // No UI drains the one-place queue: the first request fills it, the second finds it full.
-        let first = std::thread::spawn(move || exchange(addr, b"{\"id\":1,\"method\":\"m\"}\n"));
+        let first = std::thread::spawn(move || exchange(addr, req_line(1, "m").as_bytes()));
         let deadline = std::time::Instant::now() + Duration::from_secs(4);
         let busy = loop {
             let mut c = TcpStream::connect(addr).unwrap();
             c.set_read_timeout(Some(Duration::from_secs(5))).unwrap();
-            c.write_all(b"{\"id\":2,\"method\":\"m\"}\n").unwrap();
+            c.write_all(req_line(2, "m").as_bytes()).unwrap();
             let mut line = String::new();
             BufReader::new(c).read_line(&mut line).unwrap();
             let v: Value = serde_json::from_str(&line).unwrap();
@@ -350,12 +414,14 @@ mod tests {
         drop(rx);
     }
 
+    /// Replies on one authenticated connection preserve the ID of each request.
     #[test]
     fn requests_are_answered_with_their_ids() {
         let addr = serve_echo();
         let mut c = TcpStream::connect(addr).unwrap();
         c.set_read_timeout(Some(Duration::from_secs(5))).unwrap();
-        c.write_all(b"{\"id\":3,\"method\":\"ping\"}\r\n\n{\"id\":4,\"method\":\"pong\"}\n").unwrap();
+        let input = format!("{}\n{}", req_line(3, "ping").trim_end(), req_line(4, "pong"));
+        c.write_all(input.as_bytes()).unwrap();
         let mut r = BufReader::new(c);
         for (id, method) in [(3, "ping"), (4, "pong")] {
             let mut line = String::new();
@@ -365,6 +431,34 @@ mod tests {
         }
     }
 
+    /// Missing and incorrect session tokens are rejected before dispatch.
+    #[test]
+    fn a_request_without_the_token_is_unauthorized() {
+        // A local peer that does not hold the session token cannot drive the app (CWE-306).
+        let addr = serve_echo();
+        let replies = exchange(addr, b"{\"id\":9,\"method\":\"ping\"}\n");
+        assert_eq!(replies.len(), 1, "{replies:?}");
+        assert_eq!(replies[0]["ok"], false);
+        assert!(replies[0]["error"].as_str().unwrap().contains("unauthorized"), "{replies:?}");
+        // A wrong token is also refused.
+        let wrong = exchange(addr, b"{\"id\":9,\"method\":\"ping\",\"token\":\"nope\"}\n");
+        assert_eq!(wrong[0]["ok"], false);
+        assert!(wrong[0]["error"].as_str().unwrap().contains("unauthorized"), "{wrong:?}");
+    }
+
+    /// A request carrying the session token reaches the control dispatcher.
+    #[test]
+    fn a_request_with_the_token_is_dispatched() {
+        let addr = serve_echo();
+        let mut c = TcpStream::connect(addr).unwrap();
+        c.set_read_timeout(Some(Duration::from_secs(5))).unwrap();
+        c.write_all(req_line(10, "ping").as_bytes()).unwrap();
+        let mut line = String::new();
+        BufReader::new(c).read_line(&mut line).unwrap();
+        let v: Value = serde_json::from_str(&line).unwrap();
+        assert_eq!((v["ok"].as_bool(), v["method"].as_str()), (Some(true), Some("ping")), "{line}");
+    }
+
     #[test]
     fn extra_connections_are_refused() {
         let addr = serve_echo();
diff --git a/apps/cadcraft/src/logging.rs b/apps/cadcraft/src/logging.rs
index 6678dec33..4113de54f 100644
--- a/apps/cadcraft/src/logging.rs
+++ b/apps/cadcraft/src/logging.rs
@@ -93,7 +93,10 @@ fn matches(name: &str, target: &str) -> bool {
     }
 }
 
-/// `2026-10-08T07:59:17.728Z` (UTC, milliseconds). A clock before 1970 reads as the epoch.
+/// `2026-10-08T07:59:17.728Z` (UTC, milliseconds). A clock before 1970 reads as the epoch (the
+/// `duration_since` clamp); past the last date chrono can represent (year 262143) the proleptic
+/// Gregorian date is kept via the 400-year cycle rather than falling back to the epoch, so the
+/// output never changes for a value the old formatter accepted and logging never panics.
 pub fn timestamp(t: SystemTime) -> String {
     let since = t.duration_since(std::time::UNIX_EPOCH).unwrap_or_default();
     let secs = since.as_secs();
@@ -102,20 +105,25 @@ pub fn timestamp(t: SystemTime) -> String {
     format!("{y:04}-{m:02}-{d:02}T{:02}:{:02}:{:02}.{:03}Z", rem / 3600, rem % 3600 / 60, rem % 60, since.subsec_millis())
 }
 
-/// Days since 1970-01-01 to a proleptic Gregorian (year, month, day) (Howard Hinnant's
-/// `civil_from_days`, unsigned because `timestamp` clamps at the epoch; saturating so an absurd
-/// clock can't overflow).
-fn civil_from_days(days: u64) -> (u64, u64, u64) {
-    let z = days.saturating_add(719_468);
-    let era = z / 146_097;
-    let doe = z % 146_097;
-    let yoe = (doe - doe / 1460 + doe / 36_524 - doe / 146_096) / 365;
-    let doy = doe - (365 * yoe + yoe / 4 - yoe / 100);
-    let mp = (5 * doy + 2) / 153;
-    let d = doy - (153 * mp + 2) / 5 + 1;
-    let m = if mp < 10 { mp + 3 } else { mp - 9 };
-    let y = era.saturating_mul(400).saturating_add(yoe).saturating_add(u64::from(m <= 2));
-    (y, m, d)
+/// Days since 1970-01-01 → proleptic Gregorian (year, month, day).
+///
+/// `timestamp` clamps a pre-1970 clock to the epoch, so `days` is an unsigned count that can run
+/// past `NaiveDate`'s ±262143-year range. The Gregorian calendar repeats every 400 years
+/// (146_097 days), so chrono converts the day within one cycle and whole cycles go back into the
+/// year (an `i128`, then saturated into `i64`), keeping chrono as the only calendar logic and
+/// reproducing the old saturating `civil_from_days` result exactly without hand-rolled day math.
+/// 1970-01-01 is `num_days_from_ce` 719_163.
+fn civil_from_days(days: u64) -> (i64, u32, u32) {
+    use chrono::Datelike;
+    let (cycles, rest) = (days / 146_097, days % 146_097);
+    // `rest + 719_163` is 719_163..865_259, always a valid CE day.
+    match i32::try_from(rest + 719_163).ok().and_then(chrono::NaiveDate::from_num_days_from_ce_opt) {
+        Some(d) => {
+            let y = i128::from(d.year()) + i128::from(cycles) * 400;
+            (i64::try_from(y).unwrap_or(i64::MAX), d.month(), d.day())
+        }
+        None => (1970, 1, 1), // unreachable
+    }
 }
 
 fn numbered(dir: &Path, n: usize) -> PathBuf {
@@ -385,8 +393,20 @@ mod tests {
         // 2000 is a leap year (divisible by 400), 2100 is not.
         assert_eq!(timestamp(UNIX_EPOCH + Duration::from_secs(951_782_400)), "2000-02-29T00:00:00.000Z");
         assert_eq!(timestamp(UNIX_EPOCH + Duration::from_secs(4_107_542_400)), "2100-03-01T00:00:00.000Z");
-        // Before the epoch (a clock set wrong) clamps instead of panicking.
+        // Before the epoch (a clock set wrong) clamps to the epoch instead of panicking.
         assert_eq!(timestamp(UNIX_EPOCH - Duration::from_secs(5)), "1970-01-01T00:00:00.000Z");
+        // Past chrono's range (a clock set absurdly far ahead) keeps the proleptic Gregorian date
+        // the old formatter gave, rather than falling back to the epoch.
+        // Windows' SystemTime holds only up to about year 30828, so this is checked where it fits.
+        if let Some(far) = UNIX_EPOCH.checked_add(Duration::from_secs(10_000_000_000_000)) {
+            assert_eq!(timestamp(far), "318857-05-20T17:46:40.000Z");
+        }
+        // Windows' SystemTime can't hold u64::MAX / 2 seconds, so it is only checked where it exists.
+        if let Some(far) = UNIX_EPOCH.checked_add(Duration::from_secs(u64::MAX / 2)) {
+            assert_eq!(timestamp(far), "292277026596-12-04T15:30:07.000Z");
+        }
+        // Years past 9999 keep the plain zero-padded year (no `+`).
+        assert_eq!(timestamp(UNIX_EPOCH + Duration::from_secs(253_402_300_800)), "10000-01-01T00:00:00.000Z");
     }
 
     #[test]
diff --git a/crates/constraints/src/auto.rs b/crates/constraints/src/auto.rs
index d33185c60..fe7764205 100644
--- a/crates/constraints/src/auto.rs
+++ b/crates/constraints/src/auto.rs
@@ -102,7 +102,11 @@ fn ang_between(d1: Vec2, d2: Vec2) -> f64 {
 pub fn infer(d: &Drawing, handles: &[Handle], o: &InferOptions) -> Vec<Constraint> {
     let tol = if o.distance_tolerance.is_finite() { o.distance_tolerance.clamp(0.0, 1e9) } else { 0.05 };
     let atol = if o.angle_tolerance.is_finite() { o.angle_tolerance.clamp(0.0, 45.0).to_radians() } else { 1f64.to_radians() };
-    let allow = |k: ConstraintKind| o.types.is_empty() || o.types.iter().any(|t| t.eq_ignore_ascii_case(k.name()));
+    // Resolve the allowed type names into a set once, so membership is O(1) per candidate instead
+    // of re-scanning the whole (attacker-controllable) `o.types` list for every geometric match
+    // (CWE-407). Empty `o.types` means "all types".
+    let allowed: std::collections::HashSet<String> = o.types.iter().map(|t| t.to_ascii_lowercase()).collect();
+    let allow = |k: ConstraintKind| allowed.is_empty() || allowed.contains(&k.name().to_ascii_lowercase());
     let g = collect(d, handles);
     let mut out: Vec<Constraint> = Vec::new();
     let mut push = |kind: ConstraintKind, refs: Vec<GeomRef>| {
diff --git a/crates/constraints/src/dof.rs b/crates/constraints/src/dof.rs
index a3b549f96..f0a34b9f8 100644
--- a/crates/constraints/src/dof.rs
+++ b/crates/constraints/src/dof.rs
@@ -12,12 +12,15 @@ use cadcraft_doc::{Constraint, Drawing, Handle};
 use serde::Serialize;
 
 use crate::model::Model;
-use crate::{Comp, MAX_CONSTRAINTS, SolveError, SolveOptions, build, lm};
+use crate::{Comp, MAX_CONSTRAINTS, SolveError, SolveOptions, build_budgeted, lm};
 
 /// Most free parameters for which per-object freedom is analysed (null-space basis size).
 const MAX_NULL_COLS: usize = 600;
 /// Largest Jacobian (rows × columns × min) whose rank is computed.
 const MAX_RANK_WORK: f64 = 4e8;
+/// Largest residual-evaluation work (rows × free × per-residual cost, including spline
+/// reconstruction) allowed before building the Jacobian during numerical differentiation.
+const MAX_EVAL_WORK: f64 = 2e9;
 /// Most objects listed in one report.
 const MAX_OBJECTS: usize = 10_000;
 
@@ -86,6 +89,8 @@ struct CompDof {
     objects: Vec<Option<usize>>,
 }
 
+/// Compute component and object freedom only when rank and residual-evaluation work fit their budgets.
+/// Return unknown freedom before building the Jacobian when either work limit is exceeded.
 fn analyse(comp: &Comp) -> CompDof {
     let free = comp.free(None);
     let rows = comp.rows(None);
@@ -94,6 +99,14 @@ fn analyse(comp: &Comp) -> CompDof {
     if rows > lm::MAX_ROWS || (rows as f64) * (nf as f64) * (rows.min(nf) as f64) > MAX_RANK_WORK {
         return unknown;
     }
+    // Numerical differentiation evaluates every residual about `rows × free` times, and each
+    // spline-end residual reconstructs its spline through a dense solve. Account for that
+    // reconstruction cost before building the Jacobian so a component with few equations but large
+    // splines cannot pass the rank-work check yet still require billions of operations (row 43).
+    let eval_work = (rows as f64) * (nf as f64) * (1.0 + comp.built.iter().map(|b| b.spline_reconstruct_cost(&comp.model)).sum::<f64>());
+    if eval_work > MAX_EVAL_WORK {
+        return unknown;
+    }
     let f = |x: &[f64], out: &mut Vec<f64>| comp.eval(x, out, None);
     let jac = lm::jacobian(&f, &comp.model.x0, &free, rows);
     if nf > MAX_NULL_COLS {
@@ -126,7 +139,8 @@ fn plural(n: usize, one: &str, many: &str) -> String {
 /// (constrained or not) and the constraint components they belong to.
 pub fn dof(d: &Drawing, handles: &[Handle]) -> Result<DofReport, SolveError> {
     let cons: Vec<&Constraint> = d.constraints.iter().take(MAX_CONSTRAINTS).collect();
-    let (comps, _) = build(d, &cons, &SolveOptions::default())?;
+    let mut members_left = crate::model::MAX_RIGID_WORK;
+    let (comps, _) = build_budgeted(d, &cons, &SolveOptions::default(), &mut members_left)?;
     let want = |h: Handle| handles.is_empty() || handles.contains(&h);
     let mut objects = Vec::new();
     let mut seen = HashSet::new();
@@ -165,7 +179,7 @@ pub fn dof(d: &Drawing, handles: &[Handle]) -> Result<DofReport, SolveError> {
         if seen.contains(&h) {
             continue;
         }
-        let m = Model::build(d, &[h]);
+        let m = Model::build_budgeted(d, &[h], &mut members_left);
         let Some(s) = m.slots.first() else { continue };
         seen.insert(h);
         free_objects = true;
@@ -193,3 +207,35 @@ pub fn dof(d: &Drawing, handles: &[Handle]) -> Result<DofReport, SolveError> {
     };
     Ok(DofReport { dof: total, status, redundant, constraints, objects, message })
 }
+
+#[cfg(test)]
+mod budget_tests {
+    use super::*;
+    use crate::residual::{Built, Form};
+    use cadcraft_doc::{Common, ConstraintKind, EntityKind, GeomRef, Space};
+    use cadcraft_geom::{Spline, Vec2};
+
+    /// An expensive fit-spline endpoint residual produces unknown freedom before numerical differentiation.
+    #[test]
+    fn endpoint_analysis_rejects_cubic_fit_work_before_differentiation() {
+        let mut d = Drawing::default();
+        let pts: Vec<_> = (0..500).map(|i| Vec2::new(i as f64, (i % 3) as f64)).collect();
+        let mut spline = Spline::from_control(pts.clone(), 3);
+        spline.fit = pts;
+        let h = d.add(&Space::Model, Common::default(), EntityKind::Spline(spline)).unwrap();
+        let model = Model::build(&d, &[h]);
+        let endpoint = Built {
+            id: 1,
+            kind: ConstraintKind::Tangent,
+            refs: vec![GeomRef::whole(h)],
+            form: Form::EndOn { spline: 0, at_end: false },
+            target: 0.0,
+            sign: 1.0,
+            rows: 2,
+            aux_init: Vec::new(),
+            aux: 0,
+        };
+        let comp = Comp { model, built: vec![endpoint], weights: vec![1.0; 2], tol: 1e-9 };
+        assert!(analyse(&comp).dof.is_none());
+    }
+}
diff --git a/crates/constraints/src/lib.rs b/crates/constraints/src/lib.rs
index 00ba351bb..81e81fc25 100644
--- a/crates/constraints/src/lib.rs
+++ b/crates/constraints/src/lib.rs
@@ -324,12 +324,24 @@ fn components<'a>(cons: &[&'a Constraint]) -> Vec<Vec<&'a Constraint>> {
 
 /// Build the component systems. Constraints that cannot be interpreted are returned as skipped.
 pub(crate) fn build(d: &Drawing, cons: &[&Constraint], opts: &SolveOptions) -> Result<(Vec<Comp>, Vec<(u32, String)>), SolveError> {
+    let mut members_left = model::MAX_RIGID_WORK;
+    build_budgeted(d, cons, opts, &mut members_left)
+}
+
+/// Build constraint components with one caller-owned rigid-member sampling budget shared by every model.
+/// Return constraints that cannot be interpreted as skipped entries.
+pub(crate) fn build_budgeted(
+    d: &Drawing,
+    cons: &[&Constraint],
+    opts: &SolveOptions,
+    members_left: &mut usize,
+) -> Result<(Vec<Comp>, Vec<(u32, String)>), SolveError> {
     let mut e = env(d);
     let mut skipped = Vec::new();
     let mut comps = Vec::new();
     for group in components(cons) {
         let handles: Vec<Handle> = group.iter().flat_map(|c| c.refs.iter().map(|r| r.handle)).collect();
-        let mut model = Model::build(d, &handles);
+        let mut model = Model::build_budgeted(d, &handles, members_left);
         let mut built = Vec::new();
         for c in group {
             let target = if c.kind.is_dimensional() { constraint_value(&mut e, c)? } else { 0.0 };
diff --git a/crates/constraints/src/model.rs b/crates/constraints/src/model.rs
index d68f70670..ba7e58548 100644
--- a/crates/constraints/src/model.rs
+++ b/crates/constraints/src/model.rs
@@ -27,6 +27,11 @@ pub const MAX_PARAMS: usize = 4000;
 pub const MAX_SPLINE_POINTS: usize = 500;
 /// Most characteristic points of a block reference used as rigid constraint points.
 pub const MAX_RIGID_POINTS: usize = 256;
+/// Block members examined when sampling rigid points, counting those that contribute none, so a
+/// block padded with point-less entities cannot make sampling (repeated per Insert) unbounded.
+const MAX_RIGID_MEMBERS: usize = 100_000;
+/// Shared across every model built for one analysis request.
+pub(crate) const MAX_RIGID_WORK: usize = 1_000_000;
 
 #[derive(Clone, Copy, Debug, PartialEq, Eq)]
 pub(crate) enum Shape {
@@ -74,6 +79,21 @@ pub(crate) struct Model {
     rigid: HashMap<Handle, Vec<Vec2>>,
 }
 
+impl Model {
+    /// Work for a spline that an endpoint residual actually reconstructs. Fit interpolation
+    /// uses dense Gaussian elimination (cubic); control splines clone and evaluate their template.
+    pub(crate) fn spline_reconstruct_cost(&self, handle: Handle) -> f64 {
+        let Some(s) = self.splines.get(&handle) else { return 0.0 };
+        let n = s.fit.len() as f64;
+        if fit_mode(s) {
+            n * n * n
+        } else {
+            let n = s.control.len() as f64;
+            n * n
+        }
+    }
+}
+
 /// Can this entity take part in constraints?
 pub fn supported(kind: &EntityKind) -> bool {
     matches!(
@@ -93,13 +113,26 @@ pub fn supported(kind: &EntityKind) -> bool {
 /// centres, vertices, nested insertion points) of the block's own objects, at most
 /// [`MAX_RIGID_POINTS`]. Nested blocks are not entered.
 pub fn rigid_points(d: &Drawing, ins: &Insert) -> Vec<Vec2> {
+    let mut members_left = MAX_RIGID_MEMBERS;
+    rigid_points_budgeted(d, ins, &mut members_left)
+}
+
+/// Sample finite block points within per-insert and caller-shared member limits.
+/// Members that contribute no points still consume traversal work; nested blocks are not entered.
+fn rigid_points_budgeted(d: &Drawing, ins: &Insert, members_left: &mut usize) -> Vec<Vec2> {
     let Some(block) = d.block(&ins.block) else { return Vec::new() };
     let m = ins.transform(block.base.xy());
     let mut out = Vec::new();
+    // Bound the members examined, not only the points collected: entities that contribute no
+    // points (Text, Ray, …) still cost traversal, so a block full of them — scanned again for
+    // every Insert — would otherwise be unbounded (CWE-407).
+    let mut examined = 0usize;
     for e in block.entities.iter() {
-        if out.len() >= MAX_RIGID_POINTS {
+        examined += 1;
+        if out.len() >= MAX_RIGID_POINTS || examined > MAX_RIGID_MEMBERS || *members_left == 0 {
             break;
         }
+        *members_left -= 1;
         let pts: Vec<Vec2> = match &e.kind {
             EntityKind::Line(l) => vec![l.a.xy(), l.b.xy()],
             EntityKind::Arc(a) => {
@@ -152,6 +185,12 @@ fn fit_mode(s: &GSpline) -> bool {
 impl Model {
     /// Build a model for the given entities. Unsupported or missing entities are skipped.
     pub fn build(d: &Drawing, handles: &[Handle]) -> Model {
+        let mut members_left = MAX_RIGID_WORK;
+        Self::build_budgeted(d, handles, &mut members_left)
+    }
+
+    /// Build solver parameters for supported entities while sharing rigid-member sampling work with other models.
+    pub(crate) fn build_budgeted(d: &Drawing, handles: &[Handle], members_left: &mut usize) -> Model {
         let mut m = Model::default();
         for &h in handles {
             if m.index.contains_key(&h) {
@@ -208,12 +247,15 @@ impl Model {
                     // fit point; a control polygon's ends are its first and last points when the
                     // knots are clamped.
                     let ends = !sp.closed && (fit || (clamped(sp, false) && clamped(sp, true)));
-                    m.splines.insert(h, sp.clone());
+                    // Missing weights default to 1 in eval; only excess weights are unused.
+                    let mut kept = sp.clone();
+                    kept.weights.truncate(kept.control.len());
+                    m.splines.insert(h, kept);
                     Shape::Spline { n, fit, ends }
                 }
                 EntityKind::Insert(ins) => {
                     let base = Vec2::new(ins.insert.x, ins.insert.y);
-                    let pts: Vec<Vec2> = rigid_points(d, ins).into_iter().map(|p| (p - base).rotate(-ins.rotation)).collect();
+                    let pts: Vec<Vec2> = rigid_points_budgeted(d, ins, members_left).into_iter().map(|p| (p - base).rotate(-ins.rotation)).collect();
                     m.x0.extend([ins.insert.x, ins.insert.y, ins.rotation]);
                     let n = pts.len();
                     m.rigid.insert(h, pts);
@@ -573,3 +615,60 @@ impl Model {
         moved
     }
 }
+
+#[cfg(test)]
+mod budget_tests {
+    use super::*;
+    use cadcraft_doc::{Block, Common, Entity, Line, Space};
+    use cadcraft_geom::Vec3;
+    use std::sync::Arc;
+
+    /// Writing an unchanged model back leaves partial rational weights and the original spline geometry intact.
+    #[test]
+    fn write_back_keeps_partial_rational_weights() {
+        let mut drawing = Drawing::default();
+        let mut spline = GSpline::from_control(vec![Vec2::ZERO, Vec2::new(1.0, 2.0), Vec2::new(3.0, 0.0)], 2);
+        spline.weights = vec![2.0, 0.5];
+        let h = drawing.add(&Space::Model, Common::default(), EntityKind::Spline(spline.clone())).unwrap();
+        let model = Model::build(&drawing, &[h]);
+        model.write_back(&mut drawing, &model.x0);
+        let EntityKind::Spline(after) = &drawing.entity(h).unwrap().kind else { panic!("spline") };
+        assert_eq!(after.weights, spline.weights);
+        for i in 0..=10 {
+            assert!(after.eval(i as f64 / 10.0).near(spline.eval(i as f64 / 10.0), 1e-12));
+        }
+    }
+
+    /// A second model receives no sampled block points after the first model spends the shared member budget.
+    #[test]
+    fn rigid_sampling_budget_is_shared_between_models() {
+        let mut d = Drawing::default();
+        let mut block = Block::new("BAR");
+        for _ in 0..3 {
+            block.entities.push(Entity {
+                handle: d.new_handle(),
+                common: Common::default(),
+                kind: EntityKind::Line(Line { a: Vec3::ZERO, b: Vec3::new(1.0, 0.0, 0.0) }),
+            });
+        }
+        d.blocks.insert("BAR".into(), Arc::new(block));
+        let ins = Insert {
+            block: "BAR".into(),
+            insert: Vec3::ZERO,
+            scale: Vec3::new(1.0, 1.0, 1.0),
+            rotation: 0.0,
+            attribs: Vec::new(),
+            cols: 1,
+            rows: 1,
+            col_spacing: 0.0,
+            row_spacing: 0.0,
+        };
+        let h = d.add(&Space::Model, Common::default(), EntityKind::Insert(ins)).unwrap();
+        let mut budget = 2;
+        let first = Model::build_budgeted(&d, &[h], &mut budget);
+        assert_eq!(first.rigid[&h].len(), 4);
+        assert_eq!(budget, 0);
+        let next = Model::build_budgeted(&d, &[h], &mut budget);
+        assert!(next.rigid[&h].is_empty());
+    }
+}
diff --git a/crates/constraints/src/residual.rs b/crates/constraints/src/residual.rs
index 478d03aaf..be5723fec 100644
--- a/crates/constraints/src/residual.rs
+++ b/crates/constraints/src/residual.rs
@@ -116,6 +116,16 @@ fn r_at(c: &Constraint, i: usize) -> Option<&GeomRef> {
 }
 
 impl Built {
+    /// Estimate spline reconstruction work for endpoint and join residuals; other residual forms add no such cost.
+    pub(crate) fn spline_reconstruct_cost(&self, m: &Model) -> f64 {
+        let cost = |i: usize| self.refs.get(i).map_or(0.0, |r| m.spline_reconstruct_cost(r.handle));
+        match self.form {
+            Form::EndOn { spline, .. } => cost(spline),
+            Form::Join { .. } => cost(0) + cost(1),
+            _ => 0.0,
+        }
+    }
+
     /// Interpret a constraint against the model at `x`. `target` is the evaluated value for
     /// dimensional constraints (degrees for angular). Errors explain what references are needed.
     pub fn new(c: &Constraint, m: &Model, x: &[f64], target: f64) -> Result<Built, String> {
diff --git a/crates/constraints/tests/dof.rs b/crates/constraints/tests/dof.rs
index 074d8afe0..ea78ca932 100644
--- a/crates/constraints/tests/dof.rs
+++ b/crates/constraints/tests/dof.rs
@@ -363,3 +363,22 @@ fn hostile_new_geometry_never_panics() {
     let _ = dof(&d, &hs);
     let _ = dof(&d, &[Handle(0), Handle(u64::MAX)]);
 }
+
+/// Fit-point vertex constraints retain a known freedom count because they do not reconstruct the spline.
+#[test]
+fn vertex_constraints_on_large_fit_spline_do_not_charge_reconstruction() {
+    let mut d = Drawing::default();
+    let pts: Vec<_> = (0..500).map(|i| Vec2::new(i as f64, (i % 3) as f64)).collect();
+    let mut sp = GSpline::from_control(pts.clone(), 3);
+    sp.fit = pts;
+    let h = put(&mut d, EntityKind::Spline(sp));
+    for i in 0..5 {
+        let p = point(&mut d, (i as f64, (i % 3) as f64));
+        let mut c = con(K::Coincident, &[s(h, Sub::Vertex(i)), w(p)]);
+        c.id = i + 1;
+        d.constraints.push(c);
+    }
+    let report = dof(&d, &[]).unwrap();
+    assert_eq!(report.status, DofStatus::Under);
+    assert_eq!(report.dof, Some(1000));
+}
diff --git a/crates/doc/src/array.rs b/crates/doc/src/array.rs
index 57d4da532..b663785ed 100644
--- a/crates/doc/src/array.rs
+++ b/crates/doc/src/array.rs
@@ -248,10 +248,17 @@ impl ArrayParams {
             return false;
         }
         let Some(items) = self.items() else { return false };
+        // Index the replacement entries by placement so each item is matched in O(1) instead of
+        // scanning the whole `replaced` vector per item, which is quadratic when both the items
+        // and the replacements are large (CWE-407). Last entry wins, as `.rev().find` did.
+        let mut last_replaced: std::collections::HashMap<(u32, u32, u32), usize> = std::collections::HashMap::with_capacity(self.replaced.len());
+        for (idx, r) in self.replaced.iter().enumerate() {
+            last_replaced.insert((r.i, r.j, r.level), idx);
+        }
         let mut source: Option<&str> = None;
         for (it, e) in items.iter().zip(&ents) {
             let EntityKind::Insert(ins) = &e.kind else { return false };
-            match self.replaced.iter_mut().rev().find(|r| (r.i, r.j, r.level) == (it.i, it.j, it.level)) {
+            match last_replaced.get(&(it.i, it.j, it.level)).and_then(|&idx| self.replaced.get_mut(idx)) {
                 Some(r) => r.block.clone_from(&ins.block),
                 None => match source {
                     None => source = Some(&ins.block),
diff --git a/crates/doc/src/dynblock.rs b/crates/doc/src/dynblock.rs
index 6b501a83a..6887459a4 100644
--- a/crates/doc/src/dynblock.rs
+++ b/crates/doc/src/dynblock.rs
@@ -334,7 +334,11 @@ fn graph_members<'a>(objects: &HashMap<Handle, &'a ForeignObject>, xdict: Handle
     }
     let graph = objects.get(&graph?).filter(|o| o.kind.eq_ignore_ascii_case("ACAD_EVALUATION_GRAPH"))?;
     let members = section(&sections(&graph.tags), "AcDbEvalGraph").iter().filter(|t| t.code == 360).filter_map(|t| Handle::parse_hex(&t.value));
-    Some(members.take(MAX_NODES).filter_map(|h| objects.get(&h).copied()).collect())
+    // Deduplicate member handles before resolving them: a graph can list the same member many
+    // times, and parsing each occurrence into its own owned parameter multiplies a single large
+    // record into gigabytes of retained allocations (CWE-400).
+    let mut seen = std::collections::HashSet::new();
+    Some(members.take(MAX_NODES).filter(|h| seen.insert(*h)).filter_map(|h| objects.get(&h).copied()).collect())
 }
 
 /// The dynamic block data of block `name` (any case; `*Model_Space` for a drawing that is a
diff --git a/crates/doc/src/dynblock/apply.rs b/crates/doc/src/dynblock/apply.rs
index b727c1535..70ef484eb 100644
--- a/crates/doc/src/dynblock/apply.rs
+++ b/crates/doc/src/dynblock/apply.rs
@@ -464,7 +464,15 @@ fn apply(
         if !(v.x.is_finite() && v.y.is_finite()) || (v.x == 0.0 && v.y == 0.0) {
             continue;
         }
+        // Index this action's vertex lists by handle once, and skip handles already handled in
+        // this action's selection, so a selection that repeats a handle does not re-scan the
+        // vertex list and re-clone its index vector per occurrence (CWE-400).
+        let vtx_by_handle: HashMap<Handle, &Vec<i32>> = vertices.iter().rev().map(|(vh, i)| (*vh, i)).collect();
+        let mut handled: HashSet<Handle> = HashSet::new();
         for h in &a.selection {
+            if !handled.insert(*h) {
+                continue;
+            }
             if let Some(node) = param_of.get(h) {
                 // A parameter in the selection is carried along: its points in the frame. Which
                 // points are in it is decided where the dynamic block has them (AutoCAD evaluates
@@ -489,7 +497,7 @@ fn apply(
                 continue;
             }
             let Some(c) = copy_of(h) else { continue };
-            let idx = vertices.iter().find(|(vh, _)| vh == h).map(|(_, i)| i.clone());
+            let idx = vtx_by_handle.get(h).map(|i| (*i).clone());
             moves.entry(c).or_default().push((idx, v));
         }
     }
diff --git a/crates/doc/src/entity.rs b/crates/doc/src/entity.rs
index 4d22c1753..87c7e45b7 100644
--- a/crates/doc/src/entity.rs
+++ b/crates/doc/src/entity.rs
@@ -1408,9 +1408,12 @@ impl EntityKind {
             EntityKind::LwPolyline(p) => {
                 let mut g: Vec<Vec2> = Vec::new();
                 let pl = Polyline { vertices: p.vertices.clone(), closed: p.closed };
+                // Compute the segments once, not once per vertex: rebuilding the whole segment
+                // vector inside the loop is quadratic in the vertex count (CWE-407).
+                let segs = pl.segments();
                 for (i, v) in p.vertices.iter().enumerate() {
                     g.push(v.p);
-                    if let Some(s) = pl.segments().get(i) {
+                    if let Some(s) = segs.get(i) {
                         g.push(s.mid());
                     }
                 }
@@ -1468,3 +1471,21 @@ fn transform_text(t: &mut Text, m: &Mat3, s: f64, rot: f64, mirror: bool) {
     // MIRRTEXT = 0 (the default): mirrored text keeps reading left to right.
     t.rotation = cadcraft_geom::norm_angle(t.rotation + if mirror { 0.0 } else { rot });
 }
+
+#[cfg(test)]
+mod grip_tests {
+    use super::*;
+    use cadcraft_geom::PolyVertex;
+
+    #[test]
+    fn polyline_grips_are_vertices_and_midpoints() {
+        // Grips are each vertex plus the midpoint of each segment; the segment vector is computed
+        // once rather than rebuilt per vertex (CWE-407, row 35).
+        let verts: Vec<PolyVertex> = [(0.0, 0.0), (10.0, 0.0), (10.0, 10.0)].iter().map(|&(x, y)| PolyVertex::new(Vec2::new(x, y))).collect();
+        let e = EntityKind::LwPolyline(LwPolyline { vertices: verts, closed: false, const_width: 0.0, elevation: 0.0, plinegen: false });
+        let g = e.grips();
+        // 3 vertices + 2 segment midpoints.
+        assert_eq!(g.len(), 5, "{g:?}");
+        assert!(g.contains(&Vec2::new(0.0, 0.0)) && g.contains(&Vec2::new(5.0, 0.0)));
+    }
+}
diff --git a/crates/doc/src/extents.rs b/crates/doc/src/extents.rs
index 0fbd73c81..d7c7c7a8a 100644
--- a/crates/doc/src/extents.rs
+++ b/crates/doc/src/extents.rs
@@ -165,9 +165,21 @@ fn bounds_in<'a>(d: &'a Drawing, e: &Entity, depth: usize, blocks: &mut HashMap<
             if let Some(blk) = dm.block.as_ref().and_then(|n| d.block(n))
                 && depth < MAX_BLOCK_DEPTH
             {
-                for be in blk.entities.iter().filter(|be| in_block_visible(d, be)) {
-                    b = b.union(&bounds_in(d, be, depth + 1, blocks));
-                }
+                // Reuse the shared block-bounds cache (as the Insert branch does) so a dimension
+                // block with branching or self-referencing children costs one pass per definition
+                // per depth, not one per reference (which grows exponentially) (CWE-400).
+                let inner = match blocks.get(&(blk.name.as_str(), depth)) {
+                    Some(cached) => *cached,
+                    None => {
+                        let mut inner = Bounds2::EMPTY;
+                        for be in blk.entities.iter().filter(|be| in_block_visible(d, be)) {
+                            inner = inner.union(&bounds_in(d, be, depth + 1, blocks));
+                        }
+                        blocks.insert((blk.name.as_str(), depth), inner);
+                        inner
+                    }
+                };
+                b = b.union(&inner);
             }
             b
         }
diff --git a/crates/doc/src/tables.rs b/crates/doc/src/tables.rs
index 498296237..45e7a469b 100644
--- a/crates/doc/src/tables.rs
+++ b/crates/doc/src/tables.rs
@@ -752,6 +752,8 @@ pub struct PageSetup {
     pub landscape: bool,
     /// "layout" | "extents" | "display" | "window" | "limits".
     pub plot_area: String,
+    /// Plot window corners `[x1, y1, x2, y2]` (DXF plot layout groups 48, 49, 140, 141); used when `plot_area` is "window".
+    pub plot_window: [f64; 4],
     pub scale_to_fit: bool,
     /// Paper units per drawing unit.
     pub scale: f64,
@@ -779,6 +781,7 @@ impl Default for PageSetup {
             margins_mm: [6.35, 6.35, 6.35, 6.35],
             landscape: true,
             plot_area: "layout".into(),
+            plot_window: [0.0; 4],
             scale_to_fit: false,
             scale: 1.0,
             plot_style_table: String::new(),
diff --git a/crates/doc/tests/lin_pat_parse.rs b/crates/doc/tests/it/lin_pat_parse.rs
similarity index 100%
rename from crates/doc/tests/lin_pat_parse.rs
rename to crates/doc/tests/it/lin_pat_parse.rs
diff --git a/crates/doc/tests/it/main.rs b/crates/doc/tests/it/main.rs
new file mode 100644
index 000000000..dcad121df
--- /dev/null
+++ b/crates/doc/tests/it/main.rs
@@ -0,0 +1,2 @@
+mod lin_pat_parse;
+mod sub_segment_alias;
diff --git a/crates/doc/tests/sub_segment_alias.rs b/crates/doc/tests/it/sub_segment_alias.rs
similarity index 100%
rename from crates/doc/tests/sub_segment_alias.rs
rename to crates/doc/tests/it/sub_segment_alias.rs
diff --git a/crates/dwg/Cargo.toml b/crates/dwg/Cargo.toml
index 398df0a35..a409e5b90 100644
--- a/crates/dwg/Cargo.toml
+++ b/crates/dwg/Cargo.toml
@@ -10,4 +10,4 @@ workspace = true
 
 [target.'cfg(not(target_arch = "wasm32"))'.dependencies]
 # MPL-2.0: used as an unmodified dependency only (see plan/adr/0001 and NOTICE).
-acadrust = "0.6.4"
+acadrust = "0.6.5"
diff --git a/crates/dwg/src/lib.rs b/crates/dwg/src/lib.rs
index bae5c6c06..f8a48f2a0 100644
--- a/crates/dwg/src/lib.rs
+++ b/crates/dwg/src/lib.rs
@@ -4,6 +4,25 @@
 //! converted to DXF bytes, which CADCraft's own DXF reader maps to its document model; saving
 //! goes the other way. Keeping the dependency behind this byte-level API isolates it: nothing
 //! else in CADCraft depends on its types. Native targets only (it memory-maps files).
+//!
+//! # Guardrails around the third-party decoder
+//!
+//! The decoder allocates tables and section buffers from sizes a (possibly damaged or hostile)
+//! file declares, and once it starts it cannot be interrupted (an allocation failure aborts the
+//! process, which `catch_unwind` cannot recover). Because the dependency is used unmodified, this
+//! crate guards it from the outside:
+//!
+//! - Both directions reject oversized input *before* the decoder runs ([`Limits::max_dwg_bytes`]
+//!   for DWG→DXF, [`Limits::max_dxf_bytes`] for DXF→DWG), and the DWG→DXF output is capped while
+//!   it is written (`CappedWriter`).
+//! - The reader and writer run inside `catch_unwind`, so a decode failure is reported instead of
+//!   crashing.
+//!
+//! These bound the input- and output-size variants. A small file that declares a huge internal
+//! table or section can still make the dependency allocate before any size is known; fully fixing
+//! that requires an upstream fix in `acadrust` (validate declared sizes against a decoded-memory
+//! budget) or running the decode in a separate worker with an OS memory limit. The limits here
+//! keep the blast radius bounded in the meantime.
 #![deny(clippy::unwrap_used, clippy::expect_used, clippy::panic, clippy::unimplemented, clippy::todo, clippy::unreachable)]
 #![forbid(unsafe_code)]
 
@@ -88,7 +107,6 @@ mod native {
         current_style_names(&mut doc);
         table_merges(&mut doc);
         table_style_rows(&mut doc, false);
-        dimension_flags(&mut doc, false);
         let orphans = drop_orphaned_dgn_components(&mut doc);
         if orphans > 0 {
             let (s, were) = if orphans == 1 { ("", "was") } else { ("s", "were") };
@@ -272,24 +290,14 @@ mod native {
         }
     }
 
-    /// The DWG dimension flags byte. Its bit 0 is the opposite of DXF group 70's bit 128 (set: the
-    /// text is at its default position) and its bit 1 is group 70's bit 32 (ODA DWG
-    /// specification, common dimension data), while acadrust 0.6.4 reads and writes bit 0 as
-    /// `text_user_positioned` itself and keeps no bit 32 from DXF. Without this, every dimension
-    /// of a DWG CADCraft writes is user-positioned for AutoCAD (#1094), and every dimension of an
-    /// AutoCAD DWG is read as user-positioned. `to_dwg` sets the fields up for the writer:
-    /// bit 32 as CADCraft's DXF writer always sets it, and bit 0 through the inverted field;
-    /// otherwise the field is read from bit 0 after a DWG is read.
-    fn dimension_flags(doc: &mut acadrust::CadDocument, to_dwg: bool) {
+    /// The DWG dimension flags byte. Its bit 1 is DXF group 70's bit 32 (ODA DWG specification,
+    /// common dimension data), which acadrust keeps no copy of from DXF: it is set here as
+    /// CADCraft's DXF writer always sets it (#1094). Bit 0, the opposite of group 70's bit 128,
+    /// acadrust 0.6.5 reads and writes itself.
+    fn dimension_flags(doc: &mut acadrust::CadDocument) {
         for e in doc.entities_mut() {
             let acadrust::entities::EntityType::Dimension(d) = e else { continue };
-            let b = d.base_mut();
-            if to_dwg {
-                b.dwg_flags_byte |= 0x02;
-                b.text_user_positioned = !b.text_user_positioned;
-            } else {
-                b.text_user_positioned = b.dwg_flags_byte & 0x01 == 0;
-            }
+            d.base_mut().dwg_flags_byte |= 0x02;
         }
     }
 
@@ -494,7 +502,28 @@ mod native {
         }
     }
 
+    /// The current text style (`$TEXTSTYLE`) by its name, the same way as [`current_dimstyle`]:
+    /// the handle read with the DXF needn't be the style's in the document, in which case the DWG
+    /// writer fell back to Standard and AutoCAD opened the drawing with Standard current (#1650).
+    fn current_text_style(doc: &mut acadrust::CadDocument) {
+        let name = doc.header.current_text_style_name.clone();
+        if let Some(h) = doc.text_styles.iter().find(|ts| ts.name.eq_ignore_ascii_case(&name)).map(|ts| ts.handle) {
+            doc.header.current_text_style_handle = h;
+        }
+    }
+
     fn convert(dxf: &[u8], version: Option<acadrust::DxfVersion>) -> Result<Vec<u8>, String> {
+        // Reject a pathologically large DXF before handing it to the third-party decoder, which
+        // allocates tables and section buffers from the input's declared sizes and cannot be
+        // interrupted once it starts (CWE-789). This bounds the large-input variant; the decoder
+        // runs inside `catch_unwind` so a decode failure is reported rather than crashing.
+        if dxf.len() > Limits::DEFAULT.max_dxf_bytes {
+            return Err(format!(
+                "DXF: the input is {}, larger than the {} CADCraft converts to DWG",
+                mb(dxf.len() as u64),
+                mb(Limits::DEFAULT.max_dxf_bytes as u64)
+            ));
+        }
         let data = dxf.to_vec();
         let mut doc = std::panic::catch_unwind(move || acadrust::DxfReader::from_reader(Cursor::new(data)).and_then(|r| r.read()))
             .map_err(|_| "the DXF→DWG conversion failed".to_string())?
@@ -509,9 +538,10 @@ mod native {
         }
         other_layout_owners(&mut doc);
         table_style_rows(&mut doc, true);
-        dimension_flags(&mut doc, true);
+        dimension_flags(&mut doc);
         drop_unwritable(&mut doc);
         current_dimstyle(&mut doc);
+        current_text_style(&mut doc);
         std::panic::catch_unwind(AssertUnwindSafe(|| acadrust::DwgWriter::write_to_vec(&doc)))
             .map_err(|_| "the DWG writer failed on this drawing".to_string())?
             .map_err(|e| format!("DWG write: {e}"))
@@ -585,12 +615,37 @@ mod tests {
         assert_eq!(version(b"AC1018xxxx").as_deref(), Some("AC1018"));
     }
 
+    /// A DXF with ROMANS as `$TEXTSTYLE` gives a DWG whose current text style is ROMANS, not
+    /// Standard: the DXF names the style, and the handle read with it was Standard's (#1650).
+    #[cfg(not(target_arch = "wasm32"))]
+    #[test]
+    fn current_text_style_reaches_the_dwg() {
+        let header = "  0\nSECTION\n  2\nHEADER\n  9\n$ACADVER\n  1\nAC1032\n  9\n$TEXTSTYLE\n  7\nROMANS\n  0\nENDSEC\n";
+        let style = "  0\nSTYLE\n  5\n1F0\n100\nAcDbSymbolTableRecord\n100\nAcDbTextStyleTableRecord\n  2\nROMANS\n 70\n0\n";
+        let style = format!("{style} 40\n0\n 41\n1\n 50\n0\n 71\n0\n 42\n2.5\n  3\nromans.shx\n  4\n\n");
+        let dxf = format!("{header}  0\nSECTION\n  2\nTABLES\n  0\nTABLE\n  2\nSTYLE\n 70\n1\n{style}  0\nENDTAB\n  0\nENDSEC\n  0\nEOF\n");
+        let dwg = dxf_to_dwg(dxf.as_bytes()).unwrap();
+        let doc = acadrust::DwgReader::from_stream(std::io::Cursor::new(&dwg)).read().unwrap();
+        let romans = doc.text_styles.iter().find(|ts| ts.name == "ROMANS").map(|ts| ts.handle);
+        assert!(romans.is_some(), "ROMANS is missing from the DWG");
+        assert_eq!(Some(doc.header.current_text_style_handle), romans);
+    }
+
     #[test]
     fn garbage_is_an_error_not_a_crash() {
         assert!(dwg_to_dxf(b"AC1032 this is not a dwg file at all").is_err());
         assert!(dwg_to_dxf(b"").is_err());
     }
 
+    #[cfg(not(target_arch = "wasm32"))]
+    #[test]
+    fn dxf_to_dwg_rejects_garbage_without_crashing() {
+        // The DXF→DWG path runs the third-party reader inside catch_unwind and reports failures
+        // rather than crashing (and rejects oversized input before decoding).
+        assert!(dxf_to_dwg(b"not a dxf file").is_err());
+        assert!(dxf_to_dwg(b"").is_err());
+    }
+
     /// A DXF with one DIMENSION per (text, group 70, subclass, points) row.
     #[cfg(not(target_arch = "wasm32"))]
     fn dims_dxf(dims: &[(&str, i64, &str, &[(i32, [f64; 2])])]) -> String {
diff --git a/crates/engine/Cargo.toml b/crates/engine/Cargo.toml
index a19da90f9..8be55a2af 100644
--- a/crates/engine/Cargo.toml
+++ b/crates/engine/Cargo.toml
@@ -22,7 +22,10 @@ serde_json = { workspace = true }
 thiserror = { workspace = true }
 log = { workspace = true }
 # R-tree spatial index for picking, window selection and object snaps (MIT OR Apache-2.0).
-rstar = { version = "0.12", default-features = false }
+rstar = { version = "0.13", default-features = false }
+
+[target.'cfg(unix)'.dependencies]
+libc = "0.2"
 
 [dev-dependencies]
 # Real DXF files for the external reference tests (io is a lower layer).
diff --git a/crates/engine/src/atomic_write.rs b/crates/engine/src/atomic_write.rs
new file mode 100644
index 000000000..ff9e141d3
--- /dev/null
+++ b/crates/engine/src/atomic_write.rs
@@ -0,0 +1,163 @@
+//! Safe, atomic file replacement.
+//!
+//! Save, export, plot, autosave and the audit log all write a file by first putting the bytes in
+//! a sibling temporary file and then renaming it over the destination, so a failed or partial
+//! write never truncates the real file. The temporary file must be created *exclusively*: opening
+//! a predictable, pre-existing temporary path for a truncating write lets another local user plant
+//! a symlink there and redirect the write onto a file the victim can write but the attacker chose
+//! (CWE-59). [`write_atomic`] creates a fresh temporary file with `create_new` (`O_CREAT|O_EXCL`),
+//! so an existing entry at that path — symlink or not — makes the create fail rather than follow
+//! it. The handle is retained for the whole write, and only its own fresh file is renamed into
+//! place.
+
+#![cfg(not(target_arch = "wasm32"))]
+
+use std::fs::{File, OpenOptions, Permissions};
+use std::io::{self, Write};
+use std::path::{Path, PathBuf};
+use std::sync::atomic::{AtomicU64, Ordering};
+
+/// Monotonic counter making temporary names unique within this process without a RNG dependency.
+static SEQ: AtomicU64 = AtomicU64::new(0);
+
+/// How many fresh temporary names to try before giving up (each collision is another local race).
+const MAX_TRIES: u32 = 32;
+
+/// Write `bytes` to `path`, replacing it atomically and without ever following a pre-existing
+/// temporary symlink.
+///
+/// A fresh temporary file is created with exclusive semantics in `path`'s own directory, the bytes
+/// are written through the retained handle and flushed, and the temporary is then renamed over
+/// `path`. On any failure the temporary is removed and the original `path` is left untouched.
+pub fn write_atomic(path: &Path, bytes: &[u8]) -> io::Result<()> {
+    let permissions = match std::fs::symlink_metadata(path) {
+        Ok(meta) if meta.is_file() => Some(meta.permissions()),
+        Ok(_) => None,
+        Err(e) if e.kind() == io::ErrorKind::NotFound => None,
+        Err(e) => return Err(e),
+    };
+    let dir = path.parent().filter(|p| !p.as_os_str().is_empty()).map_or_else(|| PathBuf::from("."), Path::to_path_buf);
+    let (mut file, tmp) = create_temp(&dir, permissions.as_ref())?;
+    let write = (|| {
+        if let Some(permissions) = permissions {
+            file.set_permissions(permissions)?;
+        }
+        file.write_all(bytes)?;
+        file.flush()?;
+        file.sync_all()
+    })();
+    if let Err(e) = write {
+        let _ = std::fs::remove_file(&tmp);
+        return Err(e);
+    }
+    drop(file);
+    if let Err(e) = std::fs::rename(&tmp, path) {
+        let _ = std::fs::remove_file(&tmp);
+        return Err(e);
+    }
+    Ok(())
+}
+
+/// Create a fresh, exclusively-owned temporary file inside `dir`, returning its handle and path.
+///
+/// `create_new(true)` opens with `O_CREAT | O_EXCL`, which refuses to follow or reuse an existing
+/// entry (including a symlink), closing the plant-a-symlink race. Names are unpredictable enough to
+/// avoid collisions in practice, and genuine collisions are retried with a new name.
+fn create_temp(dir: &Path, permissions: Option<&Permissions>) -> io::Result<(File, PathBuf)> {
+    let pid = std::process::id();
+    let mut last_err = None;
+    for _ in 0..MAX_TRIES {
+        let seq = SEQ.fetch_add(1, Ordering::Relaxed);
+        let nanos = std::time::SystemTime::now().duration_since(std::time::UNIX_EPOCH).map(|d| d.subsec_nanos()).unwrap_or(0);
+        let tmp = dir.join(format!(".cadcraft-tmp-{pid}-{seq}-{nanos}"));
+        match create_exclusive(&tmp, permissions) {
+            Ok(file) => return Ok((file, tmp)),
+            Err(e) if e.kind() == io::ErrorKind::AlreadyExists => {
+                last_err = Some(e);
+                continue;
+            }
+            Err(e) => return Err(e),
+        }
+    }
+    Err(last_err.unwrap_or_else(|| io::Error::new(io::ErrorKind::AlreadyExists, "could not create a unique temporary file")))
+}
+
+fn create_exclusive(path: &Path, permissions: Option<&Permissions>) -> io::Result<File> {
+    let mut options = OpenOptions::new();
+    options.write(true).create_new(true);
+    #[cfg(unix)]
+    if let Some(permissions) = permissions {
+        use std::os::unix::fs::{OpenOptionsExt, PermissionsExt};
+        // Restrict access in the create syscall: chmod afterwards leaves a window in which a
+        // different user can open the inode and retain read access to bytes written later.
+        options.mode(permissions.mode() & 0o777);
+    }
+    #[cfg(not(unix))]
+    let _ = permissions;
+    options.open(path)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn replaces_contents_atomically() {
+        let dir = std::env::temp_dir().join(format!("cadcraft-aw-{}-{}", std::process::id(), SEQ.fetch_add(1, Ordering::Relaxed)));
+        std::fs::create_dir_all(&dir).unwrap();
+        let dest = dir.join("out.bin");
+        std::fs::write(&dest, b"old").unwrap();
+        write_atomic(&dest, b"new bytes").unwrap();
+        assert_eq!(std::fs::read(&dest).unwrap(), b"new bytes");
+        // No temporary files left behind.
+        let leftovers: Vec<_> =
+            std::fs::read_dir(&dir).unwrap().flatten().map(|e| e.file_name()).filter(|n| n.to_string_lossy().starts_with(".cadcraft-tmp")).collect();
+        assert!(leftovers.is_empty(), "left temp files: {leftovers:?}");
+        std::fs::remove_dir_all(&dir).ok();
+    }
+
+    #[cfg(unix)]
+    #[test]
+    fn does_not_follow_a_planted_temp_symlink() {
+        use std::os::unix::fs::symlink;
+        let dir = std::env::temp_dir().join(format!("cadcraft-aw-sym-{}-{}", std::process::id(), SEQ.fetch_add(1, Ordering::Relaxed)));
+        std::fs::create_dir_all(&dir).unwrap();
+        let victim = dir.join("victim");
+        std::fs::write(&victim, b"precious").unwrap();
+        let planted = dir.join(".cadcraft-tmp-plant");
+        symlink(&victim, &planted).unwrap();
+        assert_eq!(create_exclusive(&planted, None).unwrap_err().kind(), io::ErrorKind::AlreadyExists);
+        let dest = dir.join("drawing.dxf");
+        write_atomic(&dest, b"drawing bytes").unwrap();
+        assert_eq!(std::fs::read(&victim).unwrap(), b"precious", "victim file was overwritten");
+        assert_eq!(std::fs::read(&dest).unwrap(), b"drawing bytes");
+        std::fs::remove_dir_all(&dir).ok();
+    }
+    #[cfg(unix)]
+    #[test]
+    fn replacement_preserves_private_permissions() {
+        use std::os::unix::fs::PermissionsExt;
+        let dir = std::env::temp_dir().join(format!("cadcraft-aw-mode-{}-{}", std::process::id(), SEQ.fetch_add(1, Ordering::Relaxed)));
+        std::fs::create_dir_all(&dir).unwrap();
+        let dest = dir.join("private.adt");
+        std::fs::write(&dest, b"old").unwrap();
+        std::fs::set_permissions(&dest, std::fs::Permissions::from_mode(0o600)).unwrap();
+        write_atomic(&dest, b"private report").unwrap();
+        assert_eq!(std::fs::metadata(&dest).unwrap().permissions().mode() & 0o777, 0o600);
+        assert_eq!(std::fs::read(&dest).unwrap(), b"private report");
+        std::fs::remove_dir_all(dir).unwrap();
+    }
+    #[cfg(unix)]
+    #[test]
+    fn private_temp_is_restricted_from_creation() {
+        use std::os::unix::fs::PermissionsExt;
+        let dir = std::env::temp_dir().join(format!("cadcraft-aw-create-mode-{}-{}", std::process::id(), SEQ.fetch_add(1, Ordering::Relaxed)));
+        std::fs::create_dir_all(&dir).unwrap();
+        let path = dir.join("private-temp");
+        let permissions = Permissions::from_mode(0o600);
+        let file = create_exclusive(&path, Some(&permissions)).unwrap();
+        assert_eq!(file.metadata().unwrap().permissions().mode() & 0o077, 0);
+        drop(file);
+        std::fs::remove_dir_all(dir).unwrap();
+    }
+}
diff --git a/crates/engine/src/autosave.rs b/crates/engine/src/autosave.rs
index cee1453d1..cbb5e56ba 100644
--- a/crates/engine/src/autosave.rs
+++ b/crates/engine/src/autosave.rs
@@ -339,9 +339,9 @@ mod native {
         if let Some(dir) = Path::new(path).parent() {
             std::fs::create_dir_all(dir).map_err(|e| e.to_string())?;
         }
-        let tmp = format!("{path}.tmp");
-        std::fs::write(&tmp, bytes).map_err(|e| e.to_string())?;
-        std::fs::rename(&tmp, path).map_err(|e| e.to_string())
+        // Create a fresh temporary file exclusively and rename it into place, so a planted
+        // `<path>.tmp` symlink in a shared autosave directory cannot redirect the write (CWE-59).
+        crate::atomic_write::write_atomic(Path::new(path), &bytes).map_err(|e| e.to_string())
     }
 
     impl Autosaver {
diff --git a/crates/engine/src/capped_read.rs b/crates/engine/src/capped_read.rs
new file mode 100644
index 000000000..05c7267c9
--- /dev/null
+++ b/crates/engine/src/capped_read.rs
@@ -0,0 +1,84 @@
+//! Bounded reads of local files.
+//!
+//! Reading a path with [`std::fs::read`] buffers until EOF, so a path naming an endless readable
+//! device (for example `/dev/urandom` or a FIFO) exhausts process memory before any size check
+//! runs (CWE-400). [`read_capped`] opens the path once, refuses anything that is not a regular
+//! file, and reads through a reader limited to `max + 1` bytes so oversized input is rejected
+//! before it is fully buffered.
+
+#![cfg(not(target_arch = "wasm32"))]
+
+use std::fs::OpenOptions;
+use std::io::{self, Read};
+use std::path::Path;
+
+/// Read at most `max` bytes from the regular file at `path`.
+///
+/// Returns an error if the path is not a regular file, cannot be opened, or holds more than `max`
+/// bytes. At most `max + 1` bytes are ever buffered, so an endless device cannot exhaust memory.
+pub fn read_capped(path: &Path, max: usize) -> io::Result<Vec<u8>> {
+    let mut options = OpenOptions::new();
+    options.read(true);
+    #[cfg(unix)]
+    {
+        use std::os::unix::fs::OpenOptionsExt;
+        options.custom_flags(libc::O_NONBLOCK);
+    }
+    let file = options.open(path)?;
+    let meta = file.metadata()?;
+    if !meta.is_file() {
+        return Err(io::Error::new(io::ErrorKind::InvalidInput, "not a regular file"));
+    }
+    // Read one byte past the limit so we can tell "exactly max" from "too big" without trusting
+    // the metadata length (which a device may misreport).
+    let mut buf = Vec::new();
+    let cap = (max as u64).saturating_add(1);
+    let read = file.take(cap).read_to_end(&mut buf)?;
+    if read as u64 > max as u64 {
+        return Err(io::Error::new(io::ErrorKind::InvalidData, format!("file is larger than the {max}-byte limit")));
+    }
+    Ok(buf)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    /// Regular-file reads accept the byte boundary and reject any larger payload.
+    #[test]
+    fn reads_within_limit_and_rejects_oversize() {
+        let dir = std::env::temp_dir().join(format!("cadcraft-cr-{}", std::process::id()));
+        std::fs::create_dir_all(&dir).unwrap();
+        let p = dir.join("f.bin");
+        std::fs::write(&p, vec![7u8; 100]).unwrap();
+        assert_eq!(read_capped(&p, 100).unwrap().len(), 100);
+        assert_eq!(read_capped(&p, 200).unwrap().len(), 100);
+        assert!(read_capped(&p, 99).is_err());
+        assert_eq!(read_capped(&p, usize::MAX).unwrap().len(), 100);
+        std::fs::remove_dir_all(&dir).ok();
+    }
+
+    /// An endless device is rejected before its contents can be buffered.
+    #[cfg(unix)]
+    #[test]
+    fn rejects_non_regular_file() {
+        // /dev/zero is an endless readable device; it must be rejected, not buffered.
+        let p = Path::new("/dev/zero");
+        if p.exists() {
+            assert!(read_capped(p, 8 << 20).is_err());
+        }
+    }
+    /// Opening a FIFO without a writer returns an error without waiting for a peer.
+    #[cfg(unix)]
+    #[test]
+    fn rejects_fifo_without_a_writer() {
+        let dir = std::env::temp_dir().join(format!("cadcraft-cr-fifo-{}", std::process::id()));
+        std::fs::create_dir_all(&dir).unwrap();
+        let fifo = dir.join("pipe");
+        assert!(std::process::Command::new("mkfifo").arg(&fifo).status().unwrap().success());
+        let started = std::time::Instant::now();
+        assert_eq!(read_capped(&fifo, 1024).unwrap_err().kind(), io::ErrorKind::InvalidInput);
+        assert!(started.elapsed() < std::time::Duration::from_secs(2));
+        std::fs::remove_dir_all(dir).unwrap();
+    }
+}
diff --git a/crates/engine/src/cmd/annotate.rs b/crates/engine/src/cmd/annotate.rs
index 7fa795377..b1c732c2c 100644
--- a/crates/engine/src/cmd/annotate.rs
+++ b/crates/engine/src/cmd/annotate.rs
@@ -427,13 +427,13 @@ fn mleader_kind(s: &Session, pts: &[Vec2], text: &str, landing: bool) -> Option<
     let d = s.doc().ok()?;
     let cur = d.header.str("CMLEADERSTYLE", "Standard");
     let st = d.mleader_styles.iter().find(|m| m.name.eq_ignore_ascii_case(&cur)).or(d.mleader_styles.first()).cloned().unwrap_or_default();
-    // An annotative style's sizes are paper sizes: the annotation scale applies when drawn.
-    let k = if st.annotative { 1.0 } else { d.header.f64("DIMSCALE", 1.0) };
-    let th = st.text_height * k;
+    // The style's sizes are the drawn sizes: a multileader style has no scale of its own and
+    // DIMSCALE (a dimension-style setting) does not apply, as in AutoCAD.
+    let th = st.text_height;
     let dir = if arrow_pts.first().is_some_and(|a| a.x > landing_pt.x) { -1.0 } else { 1.0 };
     let attach = if dir > 0.0 { 4 } else { 6 };
-    let dogleg = if landing { st.dogleg * k } else { 0.0 };
-    let tpos = *landing_pt + Vec2::new((dogleg + st.landing_gap * k) * dir, 0.0);
+    let dogleg = if landing { st.dogleg } else { 0.0 };
+    let tpos = *landing_pt + Vec2::new((dogleg + st.landing_gap) * dir, 0.0);
     Some(EntityKind::MLeader(MLeader {
         leaders: vec![arrow_pts.iter().map(|p| v3(*p)).collect()],
         landing: v3(*landing_pt),
@@ -451,7 +451,7 @@ fn mleader_kind(s: &Session, pts: &[Vec2], text: &str, landing: bool) -> Option<
             columns: None,
         }),
         style: st.name.clone(),
-        arrow_size: st.arrow_size * k,
+        arrow_size: st.arrow_size,
         spline: false,
         block: None,
     }))
diff --git a/crates/engine/src/cmd/audit.rs b/crates/engine/src/cmd/audit.rs
index ac1774842..0a6805eb5 100644
--- a/crates/engine/src/cmd/audit.rs
+++ b/crates/engine/src/cmd/audit.rs
@@ -142,7 +142,10 @@ fn write_audit_log(s: &Session, report: &crate::audit::Report) {
     let Some(path) = &path_str else { return };
     let adt_path = std::path::PathBuf::from(path).with_extension("adt");
     let content = report.format_adt(&title, path_str.as_deref());
-    if let Err(e) = std::fs::write(&adt_path, content) {
+    // Write through an exclusively-created temporary and rename over the companion path, so a
+    // planted `.adt` symlink beside the drawing cannot redirect the report onto another file
+    // writable by the victim (CWE-59).
+    if let Err(e) = crate::atomic_write::write_atomic(&adt_path, content.as_bytes()) {
         log::warn!("AUDITCTL: could not write audit log {}: {e}", adt_path.display());
     }
 }
diff --git a/crates/engine/src/cmd/exchange.rs b/crates/engine/src/cmd/exchange.rs
index 5f3d30654..2829c0558 100644
--- a/crates/engine/src/cmd/exchange.rs
+++ b/crates/engine/src/cmd/exchange.rs
@@ -79,10 +79,9 @@ fn extension(path: &str) -> String {
 fn write_file(cmd: &str, path: &str, bytes: &[u8]) -> Result<()> {
     #[cfg(not(target_arch = "wasm32"))]
     {
-        let tmp = format!("{path}.cadcraft-tmp");
-        std::fs::write(&tmp, bytes).map_err(|e| bad(cmd, format!("{path}: {e}")))?;
-        std::fs::rename(&tmp, path).map_err(|e| bad(cmd, format!("{path}: {e}")))?;
-        Ok(())
+        // Exclusively create a fresh temporary file and rename it into place so a planted
+        // `<path>.cadcraft-tmp` symlink cannot redirect the export write (CWE-59).
+        crate::atomic_write::write_atomic(std::path::Path::new(path), bytes).map_err(|e| bad(cmd, format!("{path}: {e}")))
     }
     #[cfg(target_arch = "wasm32")]
     {
diff --git a/crates/engine/src/cmd/file.rs b/crates/engine/src/cmd/file.rs
index 4d184c794..b6998f424 100644
--- a/crates/engine/src/cmd/file.rs
+++ b/crates/engine/src/cmd/file.rs
@@ -19,6 +19,15 @@ pub use pgp::{MAX_ALIASES, alias_name, command_id};
 pub(crate) use pgp::{specs as alias_specs, user_alias};
 pub use template::{qnew_template, set_qnew_template};
 
+/// Largest drawing accepted from a local path, matching the per-file xref limit. A path naming an
+/// endless device must be rejected before it exhausts memory (CWE-400), so native opens read
+/// through [`crate::capped_read`] rather than buffering to EOF.
+#[cfg(not(target_arch = "wasm32"))]
+const MAX_DRAWING_BYTES: usize = 512 << 20;
+/// Largest `.scr` script accepted from a local path.
+#[cfg(not(target_arch = "wasm32"))]
+const MAX_SCRIPT_BYTES: usize = 64 << 20;
+
 /// Plot a space to PDF bytes with JSON options (`{paper?, landscape?, fit?, lineweights?, …}`).
 pub type PlotHook = fn(&Drawing, &cadcraft_doc::Space, &Value) -> std::result::Result<Vec<u8>, String>;
 
@@ -192,7 +201,8 @@ fn run_script(s: &mut Session, p: &Value) -> Result<Value> {
         let path = _path;
         #[cfg(not(target_arch = "wasm32"))]
         {
-            let bytes = std::fs::read(path).map_err(|e| bad("script", format!("{path}: {e}")))?;
+            let bytes =
+                crate::capped_read::read_capped(std::path::Path::new(path), MAX_SCRIPT_BYTES).map_err(|e| bad("script", format!("{path}: {e}")))?;
             String::from_utf8_lossy(&bytes).into_owned()
         }
         #[cfg(target_arch = "wasm32")]
@@ -265,7 +275,8 @@ pub fn read_file(path: &str) -> std::result::Result<ReadFile, String> {
     #[cfg(not(target_arch = "wasm32"))]
     {
         let r = std::panic::catch_unwind(|| {
-            let bytes = std::fs::read(path).map_err(|e| bad("open", format!("{path}: {e}")))?;
+            let bytes =
+                crate::capped_read::read_capped(std::path::Path::new(path), MAX_DRAWING_BYTES).map_err(|e| bad("open", format!("{path}: {e}")))?;
             read_bytes(&bytes, path, Some(path.to_string()))
         });
         match r {
@@ -326,13 +337,15 @@ fn opened(s: &Session, i: usize, entities: bool) -> Value {
     }
 }
 
+/// Open a drawing from bounded regular-file bytes or base64 data and resolve its external references.
 fn run_open(s: &mut Session, p: &Value) -> Result<Value> {
     if let Some(_path) = str_param(p, "path") {
         #[cfg(not(target_arch = "wasm32"))]
         let path = _path;
         #[cfg(not(target_arch = "wasm32"))]
         {
-            let bytes = std::fs::read(path).map_err(|e| bad("open", format!("{path}: {e}")))?;
+            let bytes =
+                crate::capped_read::read_capped(std::path::Path::new(path), MAX_DRAWING_BYTES).map_err(|e| bad("open", format!("{path}: {e}")))?;
             let i = open_bytes(s, &bytes, path, Some(path.to_string()))?;
             super::blocks::xref::after_open(s, i);
             return Ok(opened(s, i, true));
@@ -403,10 +416,9 @@ fn save_as(s: &mut Session, cmd: &str, path: &str, opts: &SaveAs) -> Result<usiz
 fn store(path: &str, bytes: &[u8]) -> Result<()> {
     #[cfg(not(target_arch = "wasm32"))]
     {
-        let tmp = format!("{path}.cadcraft-tmp");
-        std::fs::write(&tmp, bytes).map_err(|e| bad("save", format!("{path}: {e}")))?;
-        std::fs::rename(&tmp, path).map_err(|e| bad("save", format!("{path}: {e}")))?;
-        Ok(())
+        // Exclusively create a fresh temporary file and rename it over `path`, so a planted
+        // `<path>.cadcraft-tmp` symlink cannot redirect the write onto another file (CWE-59).
+        crate::atomic_write::write_atomic(std::path::Path::new(path), bytes).map_err(|e| bad("save", format!("{path}: {e}")))
     }
     #[cfg(target_arch = "wasm32")]
     {
diff --git a/crates/engine/src/cmd/layout.rs b/crates/engine/src/cmd/layout.rs
index cac585209..b009f687a 100644
--- a/crates/engine/src/cmd/layout.rs
+++ b/crates/engine/src/cmd/layout.rs
@@ -826,9 +826,9 @@ fn run_plot(s: &mut Session, p: &Value, cmd: &str) -> Result<Value> {
             #[cfg(not(target_arch = "wasm32"))]
             {
                 let path = _path;
-                let tmp = format!("{path}.cadcraft-tmp");
-                std::fs::write(&tmp, &bytes).map_err(|e| bad(cmd, format!("{path}: {e}")))?;
-                std::fs::rename(&tmp, path).map_err(|e| bad(cmd, format!("{path}: {e}")))?;
+                // Exclusively create a fresh temporary file and rename it into place so a planted
+                // `<path>.cadcraft-tmp` symlink cannot redirect the plot write (CWE-59).
+                crate::atomic_write::write_atomic(std::path::Path::new(path), &bytes).map_err(|e| bad(cmd, format!("{path}: {e}")))?;
                 Ok(json!({ "path": path, "bytes": bytes.len(), "layout": layout, "pages": pages }))
             }
             #[cfg(target_arch = "wasm32")]
diff --git a/crates/engine/src/doc_path.rs b/crates/engine/src/doc_path.rs
index 06b25c2fe..02dcb7efd 100644
--- a/crates/engine/src/doc_path.rs
+++ b/crates/engine/src/doc_path.rs
@@ -18,8 +18,7 @@ pub use craft_docpath::Refused;
 /// on other platforms.
 pub fn resolve(stored: &str, document: Option<&Path>) -> Result<PathBuf, Refused> {
     let document = document.filter(|d| !d.as_os_str().is_empty()).map(|d| std::path::absolute(d).unwrap_or_else(|_| d.to_path_buf()));
-    let path = craft_docpath::resolve(stored.trim(), document.as_deref())?;
-    if path.is_absolute() { Ok(path) } else { Err(Refused::Invalid) }
+    craft_docpath::resolve_absolute(stored.trim(), document.as_deref())
 }
 
 #[cfg(test)]
diff --git a/crates/engine/src/lib.rs b/crates/engine/src/lib.rs
index 1a2dfddfa..1bf8e0059 100644
--- a/crates/engine/src/lib.rs
+++ b/crates/engine/src/lib.rs
@@ -9,9 +9,13 @@
 #![forbid(unsafe_code)]
 
 pub mod assoc;
+#[cfg(not(target_arch = "wasm32"))]
+pub mod atomic_write;
 pub mod audit;
 pub mod autosave;
 pub mod blockedit;
+#[cfg(not(target_arch = "wasm32"))]
+pub mod capped_read;
 pub mod cmd;
 pub mod doc_path;
 mod finite;
diff --git a/crates/engine/src/lisp/builtins.rs b/crates/engine/src/lisp/builtins.rs
index f55351478..e421686c0 100644
--- a/crates/engine/src/lisp/builtins.rs
+++ b/crates/engine/src/lisp/builtins.rs
@@ -307,11 +307,32 @@ fn chain(a: &[Value], ok: fn(std::cmp::Ordering) -> bool) -> R {
     }
     Ok(Value::t())
 }
+/// `=` and `/=`: numbers and strings compare as [`compare`] does, and any other atom compares by
+/// what it is, as `eq` does. AutoLISP answers `(= (type x) 'LIST)` -- the idiom for a type test,
+/// since `type` returns a symbol -- where coercing that symbol to a number failed the whole
+/// routine with "bad argument type" instead (#1597). A mismatch is `nil`, not an error, so
+/// `(= 1 "1")` and `(= '(1) '(1))` answer too. The ordering comparisons stay numbers and strings
+/// only, as AutoLISP has them.
+fn eq_chain(a: &[Value], want_equal: bool) -> R {
+    arity(a, 1, usize::MAX)?;
+    for w in a.windows(2) {
+        let [x, y] = w else { continue };
+        let same = match (x, y) {
+            (Value::Str(_), Value::Str(_)) => compare(x, y)?.is_eq(),
+            _ if x.as_number().is_some() && y.as_number().is_some() => compare(x, y)?.is_eq(),
+            _ => eq(x, y),
+        };
+        if same != want_equal {
+            return Ok(Value::Nil);
+        }
+    }
+    Ok(Value::t())
+}
 fn num_eq(a: &[Value]) -> R {
-    chain(a, |o| o.is_eq())
+    eq_chain(a, true)
 }
 fn num_ne(a: &[Value]) -> R {
-    chain(a, |o| o.is_ne())
+    eq_chain(a, false)
 }
 fn lt(a: &[Value]) -> R {
     chain(a, |o| o.is_lt())
@@ -658,19 +679,47 @@ fn wcmatch(a: &[Value]) -> R {
     arity(a, 2, 2)?;
     let (s, pat) = (string(&a[0])?, string(&a[1])?);
     let text: Vec<char> = s.chars().collect();
-    Ok(Value::bool(split_patterns(&pat).iter().any(|p| match_pattern(&text, p))))
+    // Native wildcard matching runs as a single interpreter step, so its internal `*` backtracking
+    // must not explore exponentially many placements unchecked (CWE-400). Charge every glob step
+    // against a shared budget and fail the call if it is exhausted.
+    let mut budget: u64 = WCMATCH_BUDGET;
+    for p in split_patterns(&pat, &mut budget).map_err(|()| LispError::new("wcmatch: pattern too complex"))? {
+        match match_pattern(&text, &p, &mut budget) {
+            Ok(true) => return Ok(Value::bool(true)),
+            Ok(false) => {}
+            Err(()) => return Err(LispError::new("wcmatch: pattern too complex")),
+        }
+    }
+    Ok(Value::bool(false))
 }
 
-fn split_patterns(pat: &str) -> Vec<Vec<char>> {
+/// Shared step budget for one `wcmatch` call's wildcard matching. Large enough for the patterns
+/// AutoLISP routines legitimately use (including the pathological-but-bounded cases the tests
+/// cover), but finite so truly exponential `*`-heavy patterns are rejected rather than hanging.
+const WCMATCH_BUDGET: u64 = 200_000_000;
+
+/// Spend one wildcard work unit, returning an error when the shared budget is exhausted.
+fn charge_match(budget: &mut u64) -> Result<(), ()> {
+    *budget = budget.checked_sub(1).ok_or(())?;
+    Ok(())
+}
+
+/// Split comma-separated wildcard alternatives while preserving escapes and bracket sets.
+/// Every consumed character spends from the same budget used for matching.
+fn split_patterns(pat: &str, budget: &mut u64) -> Result<Vec<Vec<char>>, ()> {
     let mut out = vec![Vec::new()];
     let mut chars = pat.chars().peekable();
     let mut in_set = false;
     while let Some(c) = chars.next() {
+        charge_match(budget)?;
         match c {
             '`' => {
                 if let Some(cur) = out.last_mut() {
                     cur.push('`');
-                    cur.extend(chars.next());
+                    if let Some(escaped) = chars.next() {
+                        charge_match(budget)?;
+                        cur.push(escaped);
+                    }
                 }
             }
             '[' => {
@@ -693,41 +742,96 @@ fn split_patterns(pat: &str) -> Vec<Vec<char>> {
             }
         }
     }
-    out
+    Ok(out)
 }
 
-fn match_pattern(text: &[char], pat: &[char]) -> bool {
+/// Match one wildcard alternative, including leading `~` negation, within the shared budget.
+fn match_pattern(text: &[char], pat: &[char], budget: &mut u64) -> Result<bool, ()> {
     if let Some(('~', rest)) = pat.split_first().map(|(c, r)| (*c, r))
         && !rest.is_empty()
     {
-        return !glob(text, rest, 0);
+        return glob(text, rest, 0, budget).map(|m| !m);
     }
-    glob(text, pat, 0)
+    glob(text, pat, 0, budget)
 }
 
-/// Iterative-enough glob with `*` backtracking; `depth` bounds the recursion on `*`.
-fn glob(text: &[char], pat: &[char], depth: usize) -> bool {
+/// Iterative-enough glob with `*` backtracking; `depth` bounds the recursion on `*`. Every step is
+/// charged against `budget`; `Err(())` means the shared budget ran out (treated as too complex).
+fn glob(text: &[char], pat: &[char], depth: usize, budget: &mut u64) -> Result<bool, ()> {
+    glob_cached(text, pat, depth, budget, &mut std::collections::HashSet::new())
+}
+
+/// Match suffixes while memoizing failures; both matching work and retained failure entries are bounded.
+fn glob_cached(
+    text: &[char],
+    pat: &[char],
+    depth: usize,
+    budget: &mut u64,
+    failed: &mut std::collections::HashSet<(usize, usize, usize)>,
+) -> Result<bool, ()> {
+    charge_match(budget)?;
+    let key = (text.len(), pat.len(), depth);
+    if failed.contains(&key) {
+        return Ok(false);
+    }
+    let matched = glob_inner(text, pat, depth, budget, failed)?;
+    // Avoid revisiting the same failed suffix exponentially. Bound the memo table independently
+    // of the step limit so a very large pattern cannot turn the optimization into an allocation bomb.
+    if !matched && failed.len() < 100_000 {
+        failed.insert(key);
+    }
+    Ok(matched)
+}
+
+/// Evaluate wildcard tokens and backtracking branches under shared work and recursion limits.
+fn glob_inner(
+    text: &[char],
+    pat: &[char],
+    depth: usize,
+    budget: &mut u64,
+    failed: &mut std::collections::HashSet<(usize, usize, usize)>,
+) -> Result<bool, ()> {
+    if *budget == 0 {
+        return Err(());
+    }
+    *budget -= 1;
     if depth > 64 {
-        return false;
+        return Ok(false);
     }
     let (mut t, mut p) = (0usize, 0usize);
     while p < pat.len() {
+        charge_match(budget)?;
         match pat[p] {
             '*' => {
                 let rest = &pat[p + 1..];
-                return (t..=text.len()).any(|i| glob(&text[i..], rest, depth + 1));
+                for i in t..=text.len() {
+                    if glob_cached(&text[i..], rest, depth + 1, budget, failed)? {
+                        return Ok(true);
+                    }
+                }
+                return Ok(false);
             }
             '`' => {
-                let Some(&lit) = pat.get(p + 1) else { return false };
+                let Some(&lit) = pat.get(p + 1) else { return Ok(false) };
                 if text.get(t) != Some(&lit) {
-                    return false;
+                    return Ok(false);
                 }
                 t += 1;
                 p += 2;
             }
             '[' => {
-                let Some(close) = pat[p..].iter().position(|c| *c == ']').map(|i| p + i) else { return false };
-                let Some(&c) = text.get(t) else { return false };
+                let mut close = p;
+                while let Some(c) = pat.get(close) {
+                    charge_match(budget)?;
+                    if *c == ']' {
+                        break;
+                    }
+                    close += 1;
+                }
+                if close == pat.len() {
+                    return Ok(false);
+                }
+                let Some(&c) = text.get(t) else { return Ok(false) };
                 let set = &pat[p + 1..close];
                 let (neg, set) = match set.split_first() {
                     Some(('~', r)) if !r.is_empty() => (true, r),
@@ -736,6 +840,7 @@ fn glob(text: &[char], pat: &[char], depth: usize) -> bool {
                 let mut hit = false;
                 let mut i = 0;
                 while i < set.len() {
+                    charge_match(budget)?;
                     if set.get(i + 1) == Some(&'-') && i + 2 < set.len() {
                         if set[i] <= c && c <= set[i + 2] {
                             hit = true;
@@ -749,13 +854,13 @@ fn glob(text: &[char], pat: &[char], depth: usize) -> bool {
                     }
                 }
                 if hit == neg {
-                    return false;
+                    return Ok(false);
                 }
                 t += 1;
                 p = close + 1;
             }
             pc => {
-                let Some(&c) = text.get(t) else { return false };
+                let Some(&c) = text.get(t) else { return Ok(false) };
                 let ok = match pc {
                     '#' => c.is_ascii_digit(),
                     '@' => c.is_alphabetic(),
@@ -764,14 +869,14 @@ fn glob(text: &[char], pat: &[char], depth: usize) -> bool {
                     other => other == c,
                 };
                 if !ok {
-                    return false;
+                    return Ok(false);
                 }
                 t += 1;
                 p += 1;
             }
         }
     }
-    t == text.len()
+    Ok(t == text.len())
 }
 
 // ---------------- geometry ----------------
@@ -961,15 +1066,16 @@ fn findfile(a: &[Value]) -> R {
     Ok(if file_exists(&p) { Value::Str(p) } else { Value::Nil })
 }
 
+/// Read a regular text file up to 64 MiB, replacing invalid UTF-8 and returning `None` on read failure.
 #[cfg(not(target_arch = "wasm32"))]
 pub fn read_text_file(path: &str) -> Option<String> {
-    let bytes = std::fs::read(path).ok()?;
-    // Cap what a routine can pull into memory.
-    if bytes.len() > 64 * 1024 * 1024 {
-        return None;
-    }
+    // Read through a byte-limited, regular-file-only reader so a path naming an endless device
+    // cannot exhaust memory before the 64 MiB cap is enforced (CWE-400).
+    const MAX: usize = 64 * 1024 * 1024;
+    let bytes = crate::capped_read::read_capped(std::path::Path::new(path), MAX).ok()?;
     Some(String::from_utf8_lossy(&bytes).into_owned())
 }
+/// Return `None` on the web, where native filesystem paths are unavailable.
 #[cfg(target_arch = "wasm32")]
 pub fn read_text_file(_path: &str) -> Option<String> {
     None
@@ -1482,5 +1588,25 @@ pub fn real(r: f64) -> String {
 /// `wcmatch` for other callers (`ssget` filters).
 pub fn wild_match(text: &str, pattern: &str) -> bool {
     let t: Vec<char> = text.chars().collect();
-    split_patterns(pattern).iter().any(|p| match_pattern(&t, p))
+    let mut budget: u64 = WCMATCH_BUDGET;
+    split_patterns(pattern, &mut budget).is_ok_and(|patterns| patterns.iter().any(|p| match_pattern(&t, p, &mut budget) == Ok(true)))
+}
+
+#[cfg(test)]
+mod wildcard_budget_tests {
+    use super::*;
+
+    /// Pattern splitting, literal matching, and bracket scans all stop when their shared fuel runs out.
+    #[test]
+    fn all_native_scans_consume_fuel() {
+        assert!(split_patterns("abcdefgh", &mut 4).is_err());
+        assert!(split_patterns("`a`b`c", &mut 4).is_err());
+        let text: Vec<_> = "abcdefgh".chars().collect();
+        assert!(glob(&text, &text, 0, &mut 4).is_err());
+        let pattern: Vec<_> = "[abcdefgh]".chars().collect();
+        assert!(glob(&['!'], &pattern, 0, &mut 6).is_err());
+        // Enough for finding the closing bracket, but not scanning the entire set again.
+        assert!(glob(&['!'], &pattern, 0, &mut 14).is_err());
+        assert_eq!(glob(&['a'], &pattern, 0, &mut 100), Ok(true));
+    }
 }
diff --git a/crates/engine/src/lisp/drawing.rs b/crates/engine/src/lisp/drawing.rs
index 573eaa24a..53c7af868 100644
--- a/crates/engine/src/lisp/drawing.rs
+++ b/crates/engine/src/lisp/drawing.rs
@@ -151,16 +151,34 @@ pub fn from_json(v: &serde_json::Value) -> Value {
     }
 }
 
-/// A LISP value as JSON (for `setvar`).
-pub fn to_json(v: &Value) -> serde_json::Value {
-    match v {
+/// A LISP value as JSON (for `setvar`), bounded so a shared cons structure cannot expand into
+/// exponentially many owned array elements before the setter can reject it (CWE-400).
+///
+/// Largest number of elements it may expand, and the deepest nesting it follows.
+const TO_JSON_BUDGET: u64 = 2_000_000;
+const TO_JSON_MAX_DEPTH: usize = 256;
+
+/// Convert a LISP value to owned JSON within element and nesting limits.
+/// Return `None` before a shared cons structure can expand beyond the remaining budget.
+fn to_json_bounded(v: &Value, depth: usize, budget: &mut u64) -> Option<serde_json::Value> {
+    if depth > TO_JSON_MAX_DEPTH || *budget == 0 {
+        return None;
+    }
+    *budget -= 1;
+    Some(match v {
         Value::Nil => serde_json::Value::Null,
         Value::Int(i) => serde_json::json!(i),
         Value::Real(r) => serde_json::json!(r),
         Value::Str(s) => serde_json::json!(&**s),
-        Value::Cons(_) => serde_json::Value::Array(v.iter().map(|x| to_json(&x)).collect()),
+        Value::Cons(_) => {
+            let mut arr = Vec::new();
+            for x in v.iter() {
+                arr.push(to_json_bounded(&x, depth + 1, budget)?);
+            }
+            serde_json::Value::Array(arr)
+        }
         other => serde_json::json!(to_text(other, false)),
-    }
+    })
 }
 
 pub fn getvar(ctx: &mut Ctx<'_>, a: Vec<Value>) -> Result<Flow, LispError> {
@@ -169,10 +187,15 @@ pub fn getvar(ctx: &mut Ctx<'_>, a: Vec<Value>) -> Result<Flow, LispError> {
     Ok(Flow::Value(crate::sysvars::get(ctx.s, &name).map(|v| from_json(&v)).unwrap_or_default()))
 }
 
+/// Set a system variable after bounded JSON conversion, reporting invalid or oversized values as LISP errors.
 pub fn setvar(ctx: &mut Ctx<'_>, a: Vec<Value>) -> Result<Flow, LispError> {
     arity(&a, 2, 2)?;
     let name = string(&a[0])?;
-    match crate::sysvars::set(ctx.s, &name, &to_json(&a[1])) {
+    let mut budget: u64 = TO_JSON_BUDGET;
+    let Some(json) = to_json_bounded(&a[1], 0, &mut budget) else {
+        return Err(LispError::new(format!("AutoCAD variable setting rejected: {} value too large", to_text(&a[0], true))));
+    };
+    match crate::sysvars::set(ctx.s, &name, &json) {
         Ok(()) => Ok(Flow::Value(a[1].clone())),
         Err(_) => Err(LispError::new(format!("AutoCAD variable setting rejected: {} {}", to_text(&a[0], true), to_text(&a[1], true)))),
     }
diff --git a/crates/engine/src/lisp/eval.rs b/crates/engine/src/lisp/eval.rs
index e25798f63..3101b3933 100644
--- a/crates/engine/src/lisp/eval.rs
+++ b/crates/engine/src/lisp/eval.rs
@@ -163,7 +163,8 @@ pub struct Ctx<'a> {
 pub const MAX_STACK: usize = 100_000;
 /// Nesting depth of synchronous callbacks (`vl-sort` comparing with a LISP function, …).
 const MAX_SYNC_DEPTH: usize = 32;
-
+/// Steps per slice while driving a synchronous callback ([`Ctx::call_sync`]).
+const SYNC_SLICE: u64 = 400_000;
 enum State {
     Eval(Value),
     Ret(Value),
@@ -645,12 +646,31 @@ impl Ctx<'_> {
             super::value::charge_result(&v)?;
             return Ok(v);
         }
+        let cap = self.s.lisp.limits.callback_steps;
         let mut m = Machine::calling(f.clone(), args);
         let mut sub = Ctx { s: &mut *self.s, env: &mut *self.env, depth: self.depth + 1 };
-        match m.run(&mut sub, u64::MAX) {
-            Outcome::Done(v) => Ok(v),
-            Outcome::Error(e) => Err(e),
-            Outcome::Wait(_) => Err(LispError::new("this function can't ask for input here")),
+        // Drive the callback in bounded slices instead of granting it `u64::MAX` fuel. A `Yield`
+        // (the step budget ran out) is retried until a hard cap, so a constant-memory infinite
+        // loop inside a comparator or predicate terminates with an error rather than hanging the
+        // thread and bypassing the blocking execution cap (CWE-400).
+        let mut spent: u64 = 0;
+        loop {
+            let remaining = cap.saturating_sub(spent);
+            if remaining == 0 {
+                return Err(LispError::new(format!("callback stopped after {cap} steps")));
+            }
+            let slice = remaining.min(SYNC_SLICE);
+            match m.run(&mut sub, slice) {
+                Outcome::Done(v) => return Ok(v),
+                Outcome::Error(e) => return Err(e),
+                Outcome::Wait(Need::Yield) => {
+                    spent = spent.saturating_add(slice);
+                    if spent >= cap {
+                        return Err(LispError::new(format!("callback stopped after {cap} steps")));
+                    }
+                }
+                Outcome::Wait(_) => return Err(LispError::new("this function can't ask for input here")),
+            }
         }
     }
 }
diff --git a/crates/engine/src/lisp/input.rs b/crates/engine/src/lisp/input.rs
index fca32e5b8..d12dcbbce 100644
--- a/crates/engine/src/lisp/input.rs
+++ b/crates/engine/src/lisp/input.rs
@@ -67,6 +67,12 @@ impl GetRequest {
         let mut p = Prompt::new(message, accept).base_opt(base);
         p.keywords = self.initget.keywords.clone();
         p.raw = true;
+        // `entsel`/`nentsel` pick one object. The routine writes the message, so the prompt says
+        // so itself rather than being read for the word "Select" -- with a message of its own
+        // ("\nSelect the second line: ", or no mention of selecting at all) the pick box went
+        // missing, while the same call without one got it from the default "Select object: "
+        // (#1598).
+        p.picks_one = matches!(self.kind, GetKind::EntSel);
         p
     }
 
diff --git a/crates/engine/src/lisp/mod.rs b/crates/engine/src/lisp/mod.rs
index d9fdc9a10..47dea46df 100644
--- a/crates/engine/src/lisp/mod.rs
+++ b/crates/engine/src/lisp/mod.rs
@@ -126,11 +126,14 @@ pub(crate) struct Limits {
     pub cells: usize,
     /// Bytes of strings, printed text and files read per run.
     pub string_bytes: u64,
+    /// Maximum interpreter steps per synchronous callback.
+    pub callback_steps: u64,
 }
 
 impl Default for Limits {
+    /// Provide finite cons-cell, string-byte, and synchronous-callback limits for a LISP run.
     fn default() -> Self {
-        Limits { cells: value::MAX_CELLS, string_bytes: value::STRING_BUDGET }
+        Limits { cells: value::MAX_CELLS, string_bytes: value::STRING_BUDGET, callback_steps: 500_000_000 }
     }
 }
 
diff --git a/crates/engine/src/lisp/tests.rs b/crates/engine/src/lisp/tests.rs
index c02b48b17..9104e2525 100644
--- a/crates/engine/src/lisp/tests.rs
+++ b/crates/engine/src/lisp/tests.rs
@@ -70,6 +70,39 @@ fn arithmetic_follows_autolisp() {
     assert_eq!(eval(&mut s, "(+ 1 nil)"), Err("bad argument type: numberp: nil".into()));
 }
 
+/// `=` answers for the symbols `type` returns, which is how AutoLISP routines test a type:
+/// `(= (type x) 'INT)`. Coercing the symbol to a number failed the whole routine with "bad
+/// argument type" instead, so a routine written for AutoLISP stopped at its first type test
+/// (#1597). The ordering comparisons are still numbers and strings, as AutoLISP has them.
+#[test]
+fn equality_compares_symbols_as_autolisp_does() {
+    let mut s = session();
+    assert_eq!(ok(&mut s, "(= (type 1) 'INT)"), "T");
+    assert_eq!(ok(&mut s, "(= (type 1.0) 'INT)"), "nil");
+    assert_eq!(ok(&mut s, "(= (type '(1 2)) 'LIST)"), "T");
+    assert_eq!(ok(&mut s, "(= (type \"a\") 'STR)"), "T");
+    assert_eq!(ok(&mut s, "(/= (type 1) 'REAL)"), "T");
+    assert_eq!(ok(&mut s, "(= 'a 'a 'a)"), "T");
+    assert_eq!(ok(&mut s, "(= 'a 'b)"), "nil");
+
+    // The routine from the report runs.
+    ok(&mut s, "(defun isint (a) (if (= (type a) 'INT) T nil))");
+    assert_eq!(ok(&mut s, "(isint 3)"), "T");
+    assert_eq!(ok(&mut s, "(isint 3.0)"), "nil");
+    assert_eq!(ok(&mut s, "(isint \"3\")"), "nil");
+
+    // A mismatch of kinds is nil, not an error; numbers and strings are unchanged.
+    assert_eq!(ok(&mut s, "(= 1 \"1\")"), "nil");
+    assert_eq!(ok(&mut s, "(= '(1) '(1))"), "nil", "`=` is not `equal`");
+    assert_eq!(ok(&mut s, "(= nil nil)"), "T");
+    assert_eq!(ok(&mut s, "(= 1 1.0)"), "T");
+    assert_eq!(ok(&mut s, "(= \"a\" \"a\" \"a\")"), "T");
+    assert_eq!(ok(&mut s, "(= 1 1 2)"), "nil");
+
+    // Ordering still refuses what AutoLISP refuses.
+    assert_eq!(eval(&mut s, "(< 'a 'b)"), Err("bad argument type: numberp: A".into()));
+}
+
 #[test]
 fn lists_and_strings() {
     let mut s = session();
@@ -188,6 +221,69 @@ fn runaway_routines_are_errors_not_crashes() {
     assert_eq!(r, Ok("3000000".into()));
 }
 
+/// An infinite comparator stops at its callback cap, and a later finite comparator still succeeds.
+#[test]
+fn synchronous_callback_loop_is_an_error_not_a_hang() {
+    // A comparator with an infinite loop used to run with u64::MAX fuel and hang the thread; it
+    // now terminates at the synchronous-callback step cap (CWE-400, finding row 2).
+    let mut s = session();
+    s.lisp.limits.callback_steps = 1_000;
+    assert!(eval(&mut s, "(vl-sort '(1 2) (function (lambda (a b) (while t))))").is_err());
+    // A well-behaved comparator still works afterwards.
+    assert_eq!(ok(&mut s, "(vl-sort '(3 1 2) '<)"), "(1 2 3)");
+}
+
+/// A zero-step callback limit prevents even the first callback side effect.
+#[test]
+fn a_zero_callback_budget_does_not_run_the_callback() {
+    let mut s = session();
+    s.lisp.limits.callback_steps = 0;
+    ok(&mut s, "(setq callback-ran nil)");
+    let result = eval(&mut s, "(vl-remove-if '(lambda (x) (setq callback-ran t)) '(1))");
+    assert_eq!(result, Err("callback stopped after 0 steps".into()));
+    assert_eq!(ok(&mut s, "callback-ran"), "nil");
+}
+
+/// A callback stops at a cap smaller than one scheduling slice without completing all its assignments.
+#[test]
+fn a_callback_must_fit_within_a_partial_slice() {
+    let mut s = session();
+    s.lisp.limits.callback_steps = 1_000;
+    ok(&mut s, "(setq callback-count 0)");
+    let result = eval(&mut s, "(vl-remove-if '(lambda (x) (repeat 1000 (setq callback-count (1+ callback-count)))) '(1))");
+    assert_eq!(result, Err("callback stopped after 1000 steps".into()));
+    assert_eq!(ok(&mut s, "(and (> callback-count 0) (< callback-count 1000))"), "T");
+}
+
+/// Crossing a scheduling boundary grants only the additional configured step, rather than another slice.
+#[test]
+fn reaching_a_callback_slice_boundary_does_not_grant_another_slice() {
+    let counts: Vec<u64> = [399_999, 400_000]
+        .into_iter()
+        .map(|cap| {
+            let mut s = session();
+            s.lisp.limits.callback_steps = cap;
+            ok(&mut s, "(setq callback-count 0)");
+            let result = eval(&mut s, "(vl-remove-if '(lambda (x) (while t (setq callback-count (1+ callback-count)))) '(1))");
+            assert_eq!(result, Err(format!("callback stopped after {cap} steps")));
+            ok(&mut s, "callback-count").parse().unwrap()
+        })
+        .collect();
+    // One additional VM step can perform at most one assignment, even at SYNC_SLICE's boundary.
+    assert!(counts[0] > 0);
+    assert!(counts[1] >= counts[0] && counts[1] - counts[0] <= 1, "{counts:?}");
+}
+
+/// System-variable conversion rejects a shared list whose owned JSON expansion would exceed its budget.
+#[test]
+fn setvar_rejects_an_oversized_shared_structure() {
+    // A list repeatedly sharing its own contents expands exponentially; setvar's bounded JSON
+    // conversion rejects it instead of allocating gigabytes (CWE-400, finding row 39).
+    let mut s = session();
+    let build = "(setq x '(1)) (repeat 40 (setq x (list x x))) (setvar \"GRIDUNIT\" x)";
+    assert!(eval(&mut s, build).is_err());
+}
+
 #[test]
 fn printing() {
     let mut s = session();
@@ -452,6 +548,37 @@ fn hostile_lisp_never_panics() {
     assert!(!s.lisp_running());
 }
 
+/// `entsel` and `nentsel` pick one object, so the cursor shows the pick box at their prompt. It
+/// was read off the message's first word, and a routine's own message begins with a newline -- so
+/// the same call showed the pick box without a message and lost it with one (#1598).
+#[test]
+fn an_entsel_prompt_picks_objects_whatever_its_message_says() {
+    let mut s = session();
+    // No message: the default "Select object: ".
+    s.cmdline("(nentsel)").unwrap();
+    assert!(s.current_prompt().unwrap().picks_objects(), "{}", s.prompt_text());
+    s.cancel();
+
+    // The reported case: the routine's own message, starting with a newline.
+    s.cmdline("(nentsel \"\nSelect second line or polyline: \")").unwrap();
+    assert!(s.current_prompt().unwrap().picks_objects(), "{}", s.prompt_text());
+    s.cancel();
+
+    // Wording that never says "select" picks an object just the same.
+    s.cmdline("(entsel \"\nPick a line: \")").unwrap();
+    assert!(s.current_prompt().unwrap().picks_objects(), "{}", s.prompt_text());
+    s.cancel();
+
+    // A point prompt is not a pick, and keeps its point modifiers -- including one whose own
+    // message happens to begin with the word the built-in commands are read by. `picks_one` says
+    // which calls pick, so the wording is only ever read where the engine wrote it (#1635 review).
+    for point in ["(getpoint \"\nSpecify a point: \")", "(getpoint \"\nSelect a point: \")", "(getpoint \"Select a point: \")"] {
+        s.cmdline(point).unwrap();
+        assert!(!s.current_prompt().unwrap().picks_objects(), "{point}: {}", s.prompt_text());
+        s.cancel();
+    }
+}
+
 #[test]
 fn a_waiting_routine_is_a_prompt_with_a_rubber_band() {
     let mut s = session();
diff --git a/crates/engine/src/lisp/value.rs b/crates/engine/src/lisp/value.rs
index f05d1716a..09da1d27a 100644
--- a/crates/engine/src/lisp/value.rs
+++ b/crates/engine/src/lisp/value.rs
@@ -343,18 +343,30 @@ pub fn eq(a: &Value, b: &Value) -> bool {
 
 /// `equal`: the same structure, numbers within `fuzz`.
 pub fn equal(a: &Value, b: &Value, fuzz: f64) -> bool {
-    equal_depth(a, b, fuzz, 0)
+    // A shared cons DAG can expand into exponentially many node visits when compared as a tree.
+    // Bound the total comparisons so `equal` on adversarial shared structure cannot monopolise the
+    // thread (CWE-407); exhausting the budget reports "not equal" rather than looping.
+    let mut budget: u64 = EQUAL_BUDGET;
+    equal_depth(a, b, fuzz, 0, &mut budget)
 }
 
-fn equal_depth(a: &Value, b: &Value, fuzz: f64, depth: usize) -> bool {
-    if depth > MAX_DEPTH {
+/// Largest number of node comparisons one `equal` call may perform.
+const EQUAL_BUDGET: u64 = 50_000_000;
+
+/// Compare nested values within depth and node-work limits, returning false when either limit is reached.
+fn equal_depth(a: &Value, b: &Value, fuzz: f64, depth: usize, budget: &mut u64) -> bool {
+    if depth > MAX_DEPTH || *budget == 0 {
         return false;
     }
+    *budget -= 1;
     let (mut a, mut b) = (a.clone(), b.clone());
     loop {
+        if *budget == 0 {
+            return false;
+        }
         match (&a, &b) {
             (Value::Cons(x), Value::Cons(y)) => {
-                if !equal_depth(&x.car, &y.car, fuzz, depth + 1) {
+                if !equal_depth(&x.car, &y.car, fuzz, depth + 1, budget) {
                     return false;
                 }
                 let (na, nb) = (x.cdr.clone(), y.cdr.clone());
diff --git a/crates/engine/src/prompt.rs b/crates/engine/src/prompt.rs
index a41bcb705..b9c45eae7 100644
--- a/crates/engine/src/prompt.rs
+++ b/crates/engine/src/prompt.rs
@@ -62,6 +62,10 @@ pub struct Prompt {
     /// pointer boxes.
     #[serde(skip_serializing_if = "std::ops::Not::not")]
     pub distance: bool,
+    /// The prompt picks one object whatever it says: an AutoLISP `entsel`/`nentsel`, whose message
+    /// the routine writes, so it cannot be read for the word "Select" (#1598).
+    #[serde(skip_serializing_if = "std::ops::Not::not")]
+    pub picks_one: bool,
 }
 
 /// Parse `@distance<angle` (relative polar), returning `(distance, angle in radians)`.
@@ -128,11 +132,14 @@ impl Prompt {
         self.default = Some(d.into());
         self
     }
-    /// The prompt picks objects: a "Select objects" prompt, or a point prompt whose click selects
-    /// one object ("Select object to offset", "Select first line"…, the commands that pick a
-    /// single object themselves). The UI shows the pick box there.
+    /// The prompt picks objects: a "Select objects" prompt, one that says it picks a single object
+    /// ([`Prompt::picks_one`]), or a point prompt whose click selects one ("Select object to
+    /// offset", "Select first line"…, the commands that pick a single object themselves). The UI
+    /// shows the pick box there. The wording is only read where the engine wrote it: a routine
+    /// writes its own message (`raw`), which may open with "Select" and still ask for a point,
+    /// and says through `picks_one` when it picks instead (#1635 review).
     pub fn picks_objects(&self) -> bool {
-        self.accept.select || (self.accept.point && self.message.starts_with("Select"))
+        self.picks_one || self.accept.select || (self.accept.point && !self.raw && self.message.starts_with("Select"))
     }
     /// "Specify next point or [Undo/Close] <default>:".
     pub fn display(&self) -> String {
diff --git a/crates/engine/src/spatial.rs b/crates/engine/src/spatial.rs
index 98999b71f..ca15bd4c4 100644
--- a/crates/engine/src/spatial.rs
+++ b/crates/engine/src/spatial.rs
@@ -208,7 +208,7 @@ impl SpatialIndex {
         let pad = (b.width() + b.height()) * 1e-9 + (b.min.x.abs() + b.min.y.abs() + b.max.x.abs() + b.max.y.abs()) * 1e-12 + 1e-300;
         let env = AABB::from_corners([b.min.x - pad, b.min.y - pad], [b.max.x + pad, b.max.y + pad]);
         let mut out: Vec<u32> =
-            self.tree.locate_in_envelope_intersecting(&env).filter_map(|it| self.offsets.get(&it.data.0).map(|off| off + it.data.1)).collect();
+            self.tree.locate_in_envelope_intersecting(env).filter_map(|it| self.offsets.get(&it.data.0).map(|off| off + it.data.1)).collect();
         if with_infinite {
             out.extend_from_slice(&self.infinite);
         }
diff --git a/crates/engine/tests/angle_prompts.rs b/crates/engine/tests/it/angle_prompts.rs
similarity index 100%
rename from crates/engine/tests/angle_prompts.rs
rename to crates/engine/tests/it/angle_prompts.rs
diff --git a/crates/engine/tests/angle_settings.rs b/crates/engine/tests/it/angle_settings.rs
similarity index 100%
rename from crates/engine/tests/angle_settings.rs
rename to crates/engine/tests/it/angle_settings.rs
diff --git a/crates/engine/tests/annotate_options.rs b/crates/engine/tests/it/annotate_options.rs
similarity index 100%
rename from crates/engine/tests/annotate_options.rs
rename to crates/engine/tests/it/annotate_options.rs
diff --git a/crates/engine/tests/annotative.rs b/crates/engine/tests/it/annotative.rs
similarity index 100%
rename from crates/engine/tests/annotative.rs
rename to crates/engine/tests/it/annotative.rs
diff --git a/crates/engine/tests/arc_ctrl_direction.rs b/crates/engine/tests/it/arc_ctrl_direction.rs
similarity index 100%
rename from crates/engine/tests/arc_ctrl_direction.rs
rename to crates/engine/tests/it/arc_ctrl_direction.rs
diff --git a/crates/engine/tests/array_commands.rs b/crates/engine/tests/it/array_commands.rs
similarity index 100%
rename from crates/engine/tests/array_commands.rs
rename to crates/engine/tests/it/array_commands.rs
diff --git a/crates/engine/tests/assoc_array.rs b/crates/engine/tests/it/assoc_array.rs
similarity index 100%
rename from crates/engine/tests/assoc_array.rs
rename to crates/engine/tests/it/assoc_array.rs
diff --git a/crates/engine/tests/attdisp_attsync.rs b/crates/engine/tests/it/attdisp_attsync.rs
similarity index 100%
rename from crates/engine/tests/attdisp_attsync.rs
rename to crates/engine/tests/it/attdisp_attsync.rs
diff --git a/crates/engine/tests/attedit_prompts.rs b/crates/engine/tests/it/attedit_prompts.rs
similarity index 100%
rename from crates/engine/tests/attedit_prompts.rs
rename to crates/engine/tests/it/attedit_prompts.rs
diff --git a/crates/engine/tests/attrib_modes.rs b/crates/engine/tests/it/attrib_modes.rs
similarity index 100%
rename from crates/engine/tests/attrib_modes.rs
rename to crates/engine/tests/it/attrib_modes.rs
diff --git a/crates/engine/tests/attrib_props.rs b/crates/engine/tests/it/attrib_props.rs
similarity index 100%
rename from crates/engine/tests/attrib_props.rs
rename to crates/engine/tests/it/attrib_props.rs
diff --git a/crates/engine/tests/attribute_tools.rs b/crates/engine/tests/it/attribute_tools.rs
similarity index 100%
rename from crates/engine/tests/attribute_tools.rs
rename to crates/engine/tests/it/attribute_tools.rs
diff --git a/crates/engine/tests/block_keep.rs b/crates/engine/tests/it/block_keep.rs
similarity index 100%
rename from crates/engine/tests/block_keep.rs
rename to crates/engine/tests/it/block_keep.rs
diff --git a/crates/engine/tests/block_redefine.rs b/crates/engine/tests/it/block_redefine.rs
similarity index 100%
rename from crates/engine/tests/block_redefine.rs
rename to crates/engine/tests/it/block_redefine.rs
diff --git a/crates/engine/tests/break_closed_polyline.rs b/crates/engine/tests/it/break_closed_polyline.rs
similarity index 100%
rename from crates/engine/tests/break_closed_polyline.rs
rename to crates/engine/tests/it/break_closed_polyline.rs
diff --git a/crates/engine/tests/break_join_locked_layers.rs b/crates/engine/tests/it/break_join_locked_layers.rs
similarity index 100%
rename from crates/engine/tests/break_join_locked_layers.rs
rename to crates/engine/tests/it/break_join_locked_layers.rs
diff --git a/crates/engine/tests/break_keeps_z.rs b/crates/engine/tests/it/break_keeps_z.rs
similarity index 100%
rename from crates/engine/tests/break_keeps_z.rs
rename to crates/engine/tests/it/break_keeps_z.rs
diff --git a/crates/engine/tests/burst.rs b/crates/engine/tests/it/burst.rs
similarity index 100%
rename from crates/engine/tests/burst.rs
rename to crates/engine/tests/it/burst.rs
diff --git a/crates/engine/tests/constraint_geometry.rs b/crates/engine/tests/it/constraint_geometry.rs
similarity index 100%
rename from crates/engine/tests/constraint_geometry.rs
rename to crates/engine/tests/it/constraint_geometry.rs
diff --git a/crates/engine/tests/constraint_infer.rs b/crates/engine/tests/it/constraint_infer.rs
similarity index 100%
rename from crates/engine/tests/constraint_infer.rs
rename to crates/engine/tests/it/constraint_infer.rs
diff --git a/crates/engine/tests/count.rs b/crates/engine/tests/it/count.rs
similarity index 100%
rename from crates/engine/tests/count.rs
rename to crates/engine/tests/it/count.rs
diff --git a/crates/engine/tests/dash_block.rs b/crates/engine/tests/it/dash_block.rs
similarity index 100%
rename from crates/engine/tests/dash_block.rs
rename to crates/engine/tests/it/dash_block.rs
diff --git a/crates/engine/tests/data_extraction.rs b/crates/engine/tests/it/data_extraction.rs
similarity index 100%
rename from crates/engine/tests/data_extraction.rs
rename to crates/engine/tests/it/data_extraction.rs
diff --git a/crates/engine/tests/dim_baseline_spacing.rs b/crates/engine/tests/it/dim_baseline_spacing.rs
similarity index 100%
rename from crates/engine/tests/dim_baseline_spacing.rs
rename to crates/engine/tests/it/dim_baseline_spacing.rs
diff --git a/crates/engine/tests/dim_chain.rs b/crates/engine/tests/it/dim_chain.rs
similarity index 100%
rename from crates/engine/tests/dim_chain.rs
rename to crates/engine/tests/it/dim_chain.rs
diff --git a/crates/engine/tests/dim_commands.rs b/crates/engine/tests/it/dim_commands.rs
similarity index 100%
rename from crates/engine/tests/dim_commands.rs
rename to crates/engine/tests/it/dim_commands.rs
diff --git a/crates/engine/tests/dim_explode_text.rs b/crates/engine/tests/it/dim_explode_text.rs
similarity index 100%
rename from crates/engine/tests/dim_explode_text.rs
rename to crates/engine/tests/it/dim_explode_text.rs
diff --git a/crates/engine/tests/dim_properties.rs b/crates/engine/tests/it/dim_properties.rs
similarity index 100%
rename from crates/engine/tests/dim_properties.rs
rename to crates/engine/tests/it/dim_properties.rs
diff --git a/crates/engine/tests/dim_radial_inside.rs b/crates/engine/tests/it/dim_radial_inside.rs
similarity index 100%
rename from crates/engine/tests/dim_radial_inside.rs
rename to crates/engine/tests/it/dim_radial_inside.rs
diff --git a/crates/engine/tests/dim_radial_outside.rs b/crates/engine/tests/it/dim_radial_outside.rs
similarity index 100%
rename from crates/engine/tests/dim_radial_outside.rs
rename to crates/engine/tests/it/dim_radial_outside.rs
diff --git a/crates/engine/tests/dim_vars.rs b/crates/engine/tests/it/dim_vars.rs
similarity index 100%
rename from crates/engine/tests/dim_vars.rs
rename to crates/engine/tests/it/dim_vars.rs
diff --git a/crates/engine/tests/dimtedit_prompts.rs b/crates/engine/tests/it/dimtedit_prompts.rs
similarity index 100%
rename from crates/engine/tests/dimtedit_prompts.rs
rename to crates/engine/tests/it/dimtedit_prompts.rs
diff --git a/crates/engine/tests/drafting_spacing.rs b/crates/engine/tests/it/drafting_spacing.rs
similarity index 100%
rename from crates/engine/tests/drafting_spacing.rs
rename to crates/engine/tests/it/drafting_spacing.rs
diff --git a/crates/engine/tests/draw_prompts.rs b/crates/engine/tests/it/draw_prompts.rs
similarity index 100%
rename from crates/engine/tests/draw_prompts.rs
rename to crates/engine/tests/it/draw_prompts.rs
diff --git a/crates/engine/tests/draworder.rs b/crates/engine/tests/it/draworder.rs
similarity index 100%
rename from crates/engine/tests/draworder.rs
rename to crates/engine/tests/it/draworder.rs
diff --git a/crates/engine/tests/dyn_input.rs b/crates/engine/tests/it/dyn_input.rs
similarity index 100%
rename from crates/engine/tests/dyn_input.rs
rename to crates/engine/tests/it/dyn_input.rs
diff --git a/crates/engine/tests/dynamic_block_data.rs b/crates/engine/tests/it/dynamic_block_data.rs
similarity index 100%
rename from crates/engine/tests/dynamic_block_data.rs
rename to crates/engine/tests/it/dynamic_block_data.rs
diff --git a/crates/engine/tests/dynamic_grips.rs b/crates/engine/tests/it/dynamic_grips.rs
similarity index 99%
rename from crates/engine/tests/dynamic_grips.rs
rename to crates/engine/tests/it/dynamic_grips.rs
index 42cfaba0d..75ed1b787 100644
--- a/crates/engine/tests/dynamic_grips.rs
+++ b/crates/engine/tests/it/dynamic_grips.rs
@@ -29,7 +29,7 @@ fn session() -> (Session, Handle) {
 /// As [`session`], with the fixture's text changed by `edit` first.
 fn session_with(edit: impl Fn(String) -> String) -> (Session, Handle) {
     let grip = "0 BLOCKLINEARGRIP\n5 68\n330 61\n100 AcDbEvalExpr\n90 9\n98 33\n99 232\n100 AcDbBlockElement\n300 End Grip\n98 33\n99 232\n1071 0\n";
-    let src = include_str!("../../io/tests/data/dynblock_door.txt")
+    let src = include_str!("../../../io/tests/data/dynblock_door.txt")
         .replace("\r\n", "\n")
         .replace("170 4\n91 0\n91 0\n", "170 4\n91 8\n91 9\n")
         .replace("1030 0\n93 0\n170 0\n171 0\n100 AcDbBlockVisibilityParameter", "1030 0\n93 10\n170 0\n171 0\n100 AcDbBlockVisibilityParameter")
diff --git a/crates/engine/tests/fillet_chamfer.rs b/crates/engine/tests/it/fillet_chamfer.rs
similarity index 100%
rename from crates/engine/tests/fillet_chamfer.rs
rename to crates/engine/tests/it/fillet_chamfer.rs
diff --git a/crates/engine/tests/fix_holds_grips.rs b/crates/engine/tests/it/fix_holds_grips.rs
similarity index 100%
rename from crates/engine/tests/fix_holds_grips.rs
rename to crates/engine/tests/it/fix_holds_grips.rs
diff --git a/crates/engine/tests/followups_626.rs b/crates/engine/tests/it/followups_626.rs
similarity index 100%
rename from crates/engine/tests/followups_626.rs
rename to crates/engine/tests/it/followups_626.rs
diff --git a/crates/engine/tests/grip_dim_input.rs b/crates/engine/tests/it/grip_dim_input.rs
similarity index 100%
rename from crates/engine/tests/grip_dim_input.rs
rename to crates/engine/tests/it/grip_dim_input.rs
diff --git a/crates/engine/tests/grip_options.rs b/crates/engine/tests/it/grip_options.rs
similarity index 100%
rename from crates/engine/tests/grip_options.rs
rename to crates/engine/tests/it/grip_options.rs
diff --git a/crates/engine/tests/grip_selection.rs b/crates/engine/tests/it/grip_selection.rs
similarity index 100%
rename from crates/engine/tests/grip_selection.rs
rename to crates/engine/tests/it/grip_selection.rs
diff --git a/crates/engine/tests/group_selection.rs b/crates/engine/tests/it/group_selection.rs
similarity index 100%
rename from crates/engine/tests/group_selection.rs
rename to crates/engine/tests/it/group_selection.rs
diff --git a/crates/engine/tests/groups.rs b/crates/engine/tests/it/groups.rs
similarity index 100%
rename from crates/engine/tests/groups.rs
rename to crates/engine/tests/it/groups.rs
diff --git a/crates/engine/tests/hatch_assoc.rs b/crates/engine/tests/it/hatch_assoc.rs
similarity index 100%
rename from crates/engine/tests/hatch_assoc.rs
rename to crates/engine/tests/it/hatch_assoc.rs
diff --git a/crates/engine/tests/hatch_dialog_helpers.rs b/crates/engine/tests/it/hatch_dialog_helpers.rs
similarity index 100%
rename from crates/engine/tests/hatch_dialog_helpers.rs
rename to crates/engine/tests/it/hatch_dialog_helpers.rs
diff --git a/crates/engine/tests/hatch_numeric_validation.rs b/crates/engine/tests/it/hatch_numeric_validation.rs
similarity index 100%
rename from crates/engine/tests/hatch_numeric_validation.rs
rename to crates/engine/tests/it/hatch_numeric_validation.rs
diff --git a/crates/engine/tests/hatch_options.rs b/crates/engine/tests/it/hatch_options.rs
similarity index 100%
rename from crates/engine/tests/hatch_options.rs
rename to crates/engine/tests/it/hatch_options.rs
diff --git a/crates/engine/tests/helix.rs b/crates/engine/tests/it/helix.rs
similarity index 100%
rename from crates/engine/tests/helix.rs
rename to crates/engine/tests/it/helix.rs
diff --git a/crates/engine/tests/inquiry_keywords.rs b/crates/engine/tests/it/inquiry_keywords.rs
similarity index 100%
rename from crates/engine/tests/inquiry_keywords.rs
rename to crates/engine/tests/it/inquiry_keywords.rs
diff --git a/crates/engine/tests/inquiry_z.rs b/crates/engine/tests/it/inquiry_z.rs
similarity index 100%
rename from crates/engine/tests/inquiry_z.rs
rename to crates/engine/tests/it/inquiry_z.rs
diff --git a/crates/engine/tests/insert_prompts.rs b/crates/engine/tests/it/insert_prompts.rs
similarity index 100%
rename from crates/engine/tests/insert_prompts.rs
rename to crates/engine/tests/it/insert_prompts.rs
diff --git a/crates/engine/tests/isometric.rs b/crates/engine/tests/it/isometric.rs
similarity index 100%
rename from crates/engine/tests/isometric.rs
rename to crates/engine/tests/it/isometric.rs
diff --git a/crates/engine/tests/join_close.rs b/crates/engine/tests/it/join_close.rs
similarity index 100%
rename from crates/engine/tests/join_close.rs
rename to crates/engine/tests/it/join_close.rs
diff --git a/crates/engine/tests/json_param_validation.rs b/crates/engine/tests/it/json_param_validation.rs
similarity index 100%
rename from crates/engine/tests/json_param_validation.rs
rename to crates/engine/tests/it/json_param_validation.rs
diff --git a/crates/engine/tests/layer_cmdline.rs b/crates/engine/tests/it/layer_cmdline.rs
similarity index 100%
rename from crates/engine/tests/layer_cmdline.rs
rename to crates/engine/tests/it/layer_cmdline.rs
diff --git a/crates/engine/tests/layer_merge_delete.rs b/crates/engine/tests/it/layer_merge_delete.rs
similarity index 100%
rename from crates/engine/tests/layer_merge_delete.rs
rename to crates/engine/tests/it/layer_merge_delete.rs
diff --git a/crates/engine/tests/layoff_repeat.rs b/crates/engine/tests/it/layoff_repeat.rs
similarity index 100%
rename from crates/engine/tests/layoff_repeat.rs
rename to crates/engine/tests/it/layoff_repeat.rs
diff --git a/crates/engine/tests/layout_prompts.rs b/crates/engine/tests/it/layout_prompts.rs
similarity index 100%
rename from crates/engine/tests/layout_prompts.rs
rename to crates/engine/tests/it/layout_prompts.rs
diff --git a/crates/engine/tests/lisp_corpus.rs b/crates/engine/tests/it/lisp_corpus.rs
similarity index 99%
rename from crates/engine/tests/lisp_corpus.rs
rename to crates/engine/tests/it/lisp_corpus.rs
index 09f9ea04a..06838e3c3 100644
--- a/crates/engine/tests/lisp_corpus.rs
+++ b/crates/engine/tests/it/lisp_corpus.rs
@@ -2,7 +2,6 @@
 //! leave exactly the expected entities, layers and printed text. The corpus lives in its own
 //! repository; point `CADCRAFT_LISP_CORPUS` at its `cases` directory (or the repository) to run
 //! it. Without it the test only says so.
-#![allow(clippy::unwrap_used, clippy::expect_used, clippy::panic)]
 
 use std::path::{Path, PathBuf};
 
diff --git a/crates/engine/tests/it/main.rs b/crates/engine/tests/it/main.rs
new file mode 100644
index 000000000..b6e088a13
--- /dev/null
+++ b/crates/engine/tests/it/main.rs
@@ -0,0 +1,143 @@
+mod angle_prompts;
+mod angle_settings;
+mod annotate_options;
+mod annotative;
+mod arc_ctrl_direction;
+mod array_commands;
+mod assoc_array;
+mod attdisp_attsync;
+mod attedit_prompts;
+mod attrib_modes;
+mod attrib_props;
+mod attribute_tools;
+mod block_keep;
+mod block_redefine;
+mod break_closed_polyline;
+mod break_join_locked_layers;
+mod break_keeps_z;
+mod burst;
+mod constraint_geometry;
+mod constraint_infer;
+mod count;
+mod dash_block;
+mod data_extraction;
+mod dim_baseline_spacing;
+mod dim_chain;
+mod dim_commands;
+mod dim_explode_text;
+mod dim_properties;
+mod dim_radial_inside;
+mod dim_radial_outside;
+mod dim_vars;
+mod dimtedit_prompts;
+mod drafting_spacing;
+mod draw_prompts;
+mod draworder;
+mod dyn_input;
+mod dynamic_block_data;
+mod dynamic_grips;
+mod fillet_chamfer;
+mod fix_holds_grips;
+mod followups_626;
+mod grip_dim_input;
+mod grip_options;
+mod grip_selection;
+mod group_selection;
+mod groups;
+mod hatch_assoc;
+mod hatch_dialog_helpers;
+mod hatch_numeric_validation;
+mod hatch_options;
+mod helix;
+mod inquiry_keywords;
+mod inquiry_z;
+mod insert_prompts;
+mod isometric;
+mod join_close;
+mod json_param_validation;
+mod layer_cmdline;
+mod layer_merge_delete;
+mod layoff_repeat;
+mod layout_prompts;
+#[allow(clippy::unwrap_used, clippy::expect_used, clippy::panic)]
+mod lisp_corpus;
+mod malformed_handles;
+mod matchprop;
+mod measure_distance_snapping;
+mod metric_linetypes;
+mod mleader_content;
+mod mleader_remember;
+mod mline;
+mod mocoro;
+mod modify_curves;
+mod mtext_columns;
+mod mtext_options;
+mod multiline_attributes;
+mod named_views;
+mod non_finite_edits;
+mod offset_closed_spline;
+mod offset_ellipse_side;
+mod offset_move;
+mod options_profile;
+mod overkill;
+mod parallel_display_list;
+mod pedit_splinedit;
+mod pick_text;
+mod pickdrag;
+mod pline_arc_xline_options;
+mod plot_styles;
+mod point_modifiers;
+mod post_command_passes;
+mod prompt_keywords;
+mod props_bad_lineweight;
+mod props_insert_scale_attribs;
+mod purge_mlinestyles;
+mod purge_prompts;
+mod qdim;
+mod qdim_modes;
+mod query_entities;
+mod quickcalc;
+mod recent_commands;
+mod rectang_ortho;
+mod refedit;
+mod region;
+mod rename_cmdline;
+mod rotate_reference;
+mod select_keywords;
+mod select_similar;
+mod select_underscore_keywords;
+mod selection_cycling;
+mod selection_modes;
+mod setvar_coverage;
+mod shapes;
+mod snap_annotations;
+mod snap_blocks;
+mod snap_curves;
+mod snap_intersections_aperture;
+mod snap_nearest;
+mod snap_overrides;
+mod snap_tracking;
+mod snaps_more;
+mod space_is_enter;
+mod spline_degree;
+mod spline_options;
+mod stretch;
+mod stretch_select;
+mod table_formulas;
+mod table_styles;
+mod temp_tracking;
+mod text_commands;
+mod text_left_justify;
+mod tolerance;
+mod transparent;
+mod trim_closed_polyline;
+mod trim_extend_options;
+mod undo_count;
+mod undo_layout_tab;
+mod viewport_clip;
+mod vplayer_prompts;
+mod vports;
+mod xdata_follows_entity;
+mod zoom_keywords;
+mod zoom_viewport;
+mod zoom_window_ortho;
diff --git a/crates/engine/tests/malformed_handles.rs b/crates/engine/tests/it/malformed_handles.rs
similarity index 100%
rename from crates/engine/tests/malformed_handles.rs
rename to crates/engine/tests/it/malformed_handles.rs
diff --git a/crates/engine/tests/matchprop.rs b/crates/engine/tests/it/matchprop.rs
similarity index 100%
rename from crates/engine/tests/matchprop.rs
rename to crates/engine/tests/it/matchprop.rs
diff --git a/crates/engine/tests/measure_distance_snapping.rs b/crates/engine/tests/it/measure_distance_snapping.rs
similarity index 100%
rename from crates/engine/tests/measure_distance_snapping.rs
rename to crates/engine/tests/it/measure_distance_snapping.rs
diff --git a/crates/engine/tests/metric_linetypes.rs b/crates/engine/tests/it/metric_linetypes.rs
similarity index 100%
rename from crates/engine/tests/metric_linetypes.rs
rename to crates/engine/tests/it/metric_linetypes.rs
diff --git a/crates/engine/tests/mleader_content.rs b/crates/engine/tests/it/mleader_content.rs
similarity index 86%
rename from crates/engine/tests/mleader_content.rs
rename to crates/engine/tests/it/mleader_content.rs
index 6187504e2..c8b9a6995 100644
--- a/crates/engine/tests/mleader_content.rs
+++ b/crates/engine/tests/it/mleader_content.rs
@@ -121,3 +121,20 @@ fn json_form_takes_leader_type_and_block() {
         assert!(s.execute("mleader", &bad).is_err(), "{bad}");
     }
 }
+
+/// DIMSCALE belongs to dimension styles: a multileader keeps its style's text height, arrowhead
+/// and dogleg whatever DIMSCALE is (#1648).
+#[test]
+fn mleader_sizes_ignore_dimscale() {
+    let mut s = Session::new();
+    s.execute("mleaderstyle", &json!({"name": "M5", "textHeight": 5, "arrowSize": 5, "current": true})).unwrap();
+    s.execute("setvar", &json!({"name": "DIMSCALE", "value": 20})).unwrap();
+    s.execute("mleader", &json!({"points": [[0, 0], [30, 20]], "text": "CADCRAFT"})).unwrap();
+    let m = last_mleader(&s);
+    assert_eq!(m.arrow_size, 5.0);
+    let st = s.doc().unwrap().mleader_styles.iter().find(|x| x.name == "M5").unwrap().clone();
+    assert_eq!(m.dogleg, st.dogleg);
+    let t = m.text.unwrap();
+    assert_eq!(t.height, 5.0);
+    assert!((t.insert.x - (30.0 + st.dogleg + st.landing_gap)).abs() < 1e-9, "{}", t.insert.x);
+}
diff --git a/crates/engine/tests/mleader_remember.rs b/crates/engine/tests/it/mleader_remember.rs
similarity index 100%
rename from crates/engine/tests/mleader_remember.rs
rename to crates/engine/tests/it/mleader_remember.rs
diff --git a/crates/engine/tests/mline.rs b/crates/engine/tests/it/mline.rs
similarity index 100%
rename from crates/engine/tests/mline.rs
rename to crates/engine/tests/it/mline.rs
diff --git a/crates/engine/tests/mocoro.rs b/crates/engine/tests/it/mocoro.rs
similarity index 100%
rename from crates/engine/tests/mocoro.rs
rename to crates/engine/tests/it/mocoro.rs
diff --git a/crates/engine/tests/modify_curves.rs b/crates/engine/tests/it/modify_curves.rs
similarity index 100%
rename from crates/engine/tests/modify_curves.rs
rename to crates/engine/tests/it/modify_curves.rs
diff --git a/crates/engine/tests/mtext_columns.rs b/crates/engine/tests/it/mtext_columns.rs
similarity index 100%
rename from crates/engine/tests/mtext_columns.rs
rename to crates/engine/tests/it/mtext_columns.rs
diff --git a/crates/engine/tests/mtext_options.rs b/crates/engine/tests/it/mtext_options.rs
similarity index 100%
rename from crates/engine/tests/mtext_options.rs
rename to crates/engine/tests/it/mtext_options.rs
diff --git a/crates/engine/tests/multiline_attributes.rs b/crates/engine/tests/it/multiline_attributes.rs
similarity index 100%
rename from crates/engine/tests/multiline_attributes.rs
rename to crates/engine/tests/it/multiline_attributes.rs
diff --git a/crates/engine/tests/named_views.rs b/crates/engine/tests/it/named_views.rs
similarity index 100%
rename from crates/engine/tests/named_views.rs
rename to crates/engine/tests/it/named_views.rs
diff --git a/crates/engine/tests/non_finite_edits.rs b/crates/engine/tests/it/non_finite_edits.rs
similarity index 100%
rename from crates/engine/tests/non_finite_edits.rs
rename to crates/engine/tests/it/non_finite_edits.rs
diff --git a/crates/engine/tests/offset_closed_spline.rs b/crates/engine/tests/it/offset_closed_spline.rs
similarity index 100%
rename from crates/engine/tests/offset_closed_spline.rs
rename to crates/engine/tests/it/offset_closed_spline.rs
diff --git a/crates/engine/tests/offset_ellipse_side.rs b/crates/engine/tests/it/offset_ellipse_side.rs
similarity index 100%
rename from crates/engine/tests/offset_ellipse_side.rs
rename to crates/engine/tests/it/offset_ellipse_side.rs
diff --git a/crates/engine/tests/offset_move.rs b/crates/engine/tests/it/offset_move.rs
similarity index 100%
rename from crates/engine/tests/offset_move.rs
rename to crates/engine/tests/it/offset_move.rs
diff --git a/crates/engine/tests/options_profile.rs b/crates/engine/tests/it/options_profile.rs
similarity index 100%
rename from crates/engine/tests/options_profile.rs
rename to crates/engine/tests/it/options_profile.rs
diff --git a/crates/engine/tests/overkill.rs b/crates/engine/tests/it/overkill.rs
similarity index 100%
rename from crates/engine/tests/overkill.rs
rename to crates/engine/tests/it/overkill.rs
diff --git a/crates/engine/tests/parallel_display_list.rs b/crates/engine/tests/it/parallel_display_list.rs
similarity index 100%
rename from crates/engine/tests/parallel_display_list.rs
rename to crates/engine/tests/it/parallel_display_list.rs
diff --git a/crates/engine/tests/pedit_splinedit.rs b/crates/engine/tests/it/pedit_splinedit.rs
similarity index 100%
rename from crates/engine/tests/pedit_splinedit.rs
rename to crates/engine/tests/it/pedit_splinedit.rs
diff --git a/crates/engine/tests/pick_text.rs b/crates/engine/tests/it/pick_text.rs
similarity index 100%
rename from crates/engine/tests/pick_text.rs
rename to crates/engine/tests/it/pick_text.rs
diff --git a/crates/engine/tests/pickdrag.rs b/crates/engine/tests/it/pickdrag.rs
similarity index 100%
rename from crates/engine/tests/pickdrag.rs
rename to crates/engine/tests/it/pickdrag.rs
diff --git a/crates/engine/tests/pline_arc_xline_options.rs b/crates/engine/tests/it/pline_arc_xline_options.rs
similarity index 100%
rename from crates/engine/tests/pline_arc_xline_options.rs
rename to crates/engine/tests/it/pline_arc_xline_options.rs
diff --git a/crates/engine/tests/plot_styles.rs b/crates/engine/tests/it/plot_styles.rs
similarity index 100%
rename from crates/engine/tests/plot_styles.rs
rename to crates/engine/tests/it/plot_styles.rs
diff --git a/crates/engine/tests/point_modifiers.rs b/crates/engine/tests/it/point_modifiers.rs
similarity index 100%
rename from crates/engine/tests/point_modifiers.rs
rename to crates/engine/tests/it/point_modifiers.rs
diff --git a/crates/engine/tests/post_command_passes.rs b/crates/engine/tests/it/post_command_passes.rs
similarity index 100%
rename from crates/engine/tests/post_command_passes.rs
rename to crates/engine/tests/it/post_command_passes.rs
diff --git a/crates/engine/tests/prompt_keywords.rs b/crates/engine/tests/it/prompt_keywords.rs
similarity index 100%
rename from crates/engine/tests/prompt_keywords.rs
rename to crates/engine/tests/it/prompt_keywords.rs
diff --git a/crates/engine/tests/props_bad_lineweight.rs b/crates/engine/tests/it/props_bad_lineweight.rs
similarity index 100%
rename from crates/engine/tests/props_bad_lineweight.rs
rename to crates/engine/tests/it/props_bad_lineweight.rs
diff --git a/crates/engine/tests/props_insert_scale_attribs.rs b/crates/engine/tests/it/props_insert_scale_attribs.rs
similarity index 100%
rename from crates/engine/tests/props_insert_scale_attribs.rs
rename to crates/engine/tests/it/props_insert_scale_attribs.rs
diff --git a/crates/engine/tests/purge_mlinestyles.rs b/crates/engine/tests/it/purge_mlinestyles.rs
similarity index 100%
rename from crates/engine/tests/purge_mlinestyles.rs
rename to crates/engine/tests/it/purge_mlinestyles.rs
diff --git a/crates/engine/tests/purge_prompts.rs b/crates/engine/tests/it/purge_prompts.rs
similarity index 100%
rename from crates/engine/tests/purge_prompts.rs
rename to crates/engine/tests/it/purge_prompts.rs
diff --git a/crates/engine/tests/qdim.rs b/crates/engine/tests/it/qdim.rs
similarity index 100%
rename from crates/engine/tests/qdim.rs
rename to crates/engine/tests/it/qdim.rs
diff --git a/crates/engine/tests/qdim_modes.rs b/crates/engine/tests/it/qdim_modes.rs
similarity index 100%
rename from crates/engine/tests/qdim_modes.rs
rename to crates/engine/tests/it/qdim_modes.rs
diff --git a/crates/engine/tests/query_entities.rs b/crates/engine/tests/it/query_entities.rs
similarity index 100%
rename from crates/engine/tests/query_entities.rs
rename to crates/engine/tests/it/query_entities.rs
diff --git a/crates/engine/tests/quickcalc.rs b/crates/engine/tests/it/quickcalc.rs
similarity index 100%
rename from crates/engine/tests/quickcalc.rs
rename to crates/engine/tests/it/quickcalc.rs
diff --git a/crates/engine/tests/recent_commands.rs b/crates/engine/tests/it/recent_commands.rs
similarity index 100%
rename from crates/engine/tests/recent_commands.rs
rename to crates/engine/tests/it/recent_commands.rs
diff --git a/crates/engine/tests/rectang_ortho.rs b/crates/engine/tests/it/rectang_ortho.rs
similarity index 100%
rename from crates/engine/tests/rectang_ortho.rs
rename to crates/engine/tests/it/rectang_ortho.rs
diff --git a/crates/engine/tests/refedit.rs b/crates/engine/tests/it/refedit.rs
similarity index 100%
rename from crates/engine/tests/refedit.rs
rename to crates/engine/tests/it/refedit.rs
diff --git a/crates/engine/tests/region.rs b/crates/engine/tests/it/region.rs
similarity index 100%
rename from crates/engine/tests/region.rs
rename to crates/engine/tests/it/region.rs
diff --git a/crates/engine/tests/rename_cmdline.rs b/crates/engine/tests/it/rename_cmdline.rs
similarity index 100%
rename from crates/engine/tests/rename_cmdline.rs
rename to crates/engine/tests/it/rename_cmdline.rs
diff --git a/crates/engine/tests/rotate_reference.rs b/crates/engine/tests/it/rotate_reference.rs
similarity index 100%
rename from crates/engine/tests/rotate_reference.rs
rename to crates/engine/tests/it/rotate_reference.rs
diff --git a/crates/engine/tests/select_keywords.rs b/crates/engine/tests/it/select_keywords.rs
similarity index 100%
rename from crates/engine/tests/select_keywords.rs
rename to crates/engine/tests/it/select_keywords.rs
diff --git a/crates/engine/tests/select_similar.rs b/crates/engine/tests/it/select_similar.rs
similarity index 100%
rename from crates/engine/tests/select_similar.rs
rename to crates/engine/tests/it/select_similar.rs
diff --git a/crates/engine/tests/select_underscore_keywords.rs b/crates/engine/tests/it/select_underscore_keywords.rs
similarity index 100%
rename from crates/engine/tests/select_underscore_keywords.rs
rename to crates/engine/tests/it/select_underscore_keywords.rs
diff --git a/crates/engine/tests/selection_cycling.rs b/crates/engine/tests/it/selection_cycling.rs
similarity index 100%
rename from crates/engine/tests/selection_cycling.rs
rename to crates/engine/tests/it/selection_cycling.rs
diff --git a/crates/engine/tests/selection_modes.rs b/crates/engine/tests/it/selection_modes.rs
similarity index 100%
rename from crates/engine/tests/selection_modes.rs
rename to crates/engine/tests/it/selection_modes.rs
diff --git a/crates/engine/tests/setvar_coverage.rs b/crates/engine/tests/it/setvar_coverage.rs
similarity index 100%
rename from crates/engine/tests/setvar_coverage.rs
rename to crates/engine/tests/it/setvar_coverage.rs
diff --git a/crates/engine/tests/shapes.rs b/crates/engine/tests/it/shapes.rs
similarity index 100%
rename from crates/engine/tests/shapes.rs
rename to crates/engine/tests/it/shapes.rs
diff --git a/crates/engine/tests/snap_annotations.rs b/crates/engine/tests/it/snap_annotations.rs
similarity index 100%
rename from crates/engine/tests/snap_annotations.rs
rename to crates/engine/tests/it/snap_annotations.rs
diff --git a/crates/engine/tests/snap_blocks.rs b/crates/engine/tests/it/snap_blocks.rs
similarity index 100%
rename from crates/engine/tests/snap_blocks.rs
rename to crates/engine/tests/it/snap_blocks.rs
diff --git a/crates/engine/tests/snap_curves.rs b/crates/engine/tests/it/snap_curves.rs
similarity index 100%
rename from crates/engine/tests/snap_curves.rs
rename to crates/engine/tests/it/snap_curves.rs
diff --git a/crates/engine/tests/snap_intersections_aperture.rs b/crates/engine/tests/it/snap_intersections_aperture.rs
similarity index 100%
rename from crates/engine/tests/snap_intersections_aperture.rs
rename to crates/engine/tests/it/snap_intersections_aperture.rs
diff --git a/crates/engine/tests/snap_nearest.rs b/crates/engine/tests/it/snap_nearest.rs
similarity index 100%
rename from crates/engine/tests/snap_nearest.rs
rename to crates/engine/tests/it/snap_nearest.rs
diff --git a/crates/engine/tests/snap_overrides.rs b/crates/engine/tests/it/snap_overrides.rs
similarity index 100%
rename from crates/engine/tests/snap_overrides.rs
rename to crates/engine/tests/it/snap_overrides.rs
diff --git a/crates/engine/tests/snap_tracking.rs b/crates/engine/tests/it/snap_tracking.rs
similarity index 100%
rename from crates/engine/tests/snap_tracking.rs
rename to crates/engine/tests/it/snap_tracking.rs
diff --git a/crates/engine/tests/snaps_more.rs b/crates/engine/tests/it/snaps_more.rs
similarity index 100%
rename from crates/engine/tests/snaps_more.rs
rename to crates/engine/tests/it/snaps_more.rs
diff --git a/crates/engine/tests/space_is_enter.rs b/crates/engine/tests/it/space_is_enter.rs
similarity index 100%
rename from crates/engine/tests/space_is_enter.rs
rename to crates/engine/tests/it/space_is_enter.rs
diff --git a/crates/engine/tests/spline_degree.rs b/crates/engine/tests/it/spline_degree.rs
similarity index 100%
rename from crates/engine/tests/spline_degree.rs
rename to crates/engine/tests/it/spline_degree.rs
diff --git a/crates/engine/tests/spline_options.rs b/crates/engine/tests/it/spline_options.rs
similarity index 100%
rename from crates/engine/tests/spline_options.rs
rename to crates/engine/tests/it/spline_options.rs
diff --git a/crates/engine/tests/stretch.rs b/crates/engine/tests/it/stretch.rs
similarity index 100%
rename from crates/engine/tests/stretch.rs
rename to crates/engine/tests/it/stretch.rs
diff --git a/crates/engine/tests/stretch_select.rs b/crates/engine/tests/it/stretch_select.rs
similarity index 100%
rename from crates/engine/tests/stretch_select.rs
rename to crates/engine/tests/it/stretch_select.rs
diff --git a/crates/engine/tests/table_formulas.rs b/crates/engine/tests/it/table_formulas.rs
similarity index 100%
rename from crates/engine/tests/table_formulas.rs
rename to crates/engine/tests/it/table_formulas.rs
diff --git a/crates/engine/tests/table_styles.rs b/crates/engine/tests/it/table_styles.rs
similarity index 100%
rename from crates/engine/tests/table_styles.rs
rename to crates/engine/tests/it/table_styles.rs
diff --git a/crates/engine/tests/temp_tracking.rs b/crates/engine/tests/it/temp_tracking.rs
similarity index 100%
rename from crates/engine/tests/temp_tracking.rs
rename to crates/engine/tests/it/temp_tracking.rs
diff --git a/crates/engine/tests/text_commands.rs b/crates/engine/tests/it/text_commands.rs
similarity index 100%
rename from crates/engine/tests/text_commands.rs
rename to crates/engine/tests/it/text_commands.rs
diff --git a/crates/engine/tests/text_left_justify.rs b/crates/engine/tests/it/text_left_justify.rs
similarity index 100%
rename from crates/engine/tests/text_left_justify.rs
rename to crates/engine/tests/it/text_left_justify.rs
diff --git a/crates/engine/tests/tolerance.rs b/crates/engine/tests/it/tolerance.rs
similarity index 100%
rename from crates/engine/tests/tolerance.rs
rename to crates/engine/tests/it/tolerance.rs
diff --git a/crates/engine/tests/transparent.rs b/crates/engine/tests/it/transparent.rs
similarity index 100%
rename from crates/engine/tests/transparent.rs
rename to crates/engine/tests/it/transparent.rs
diff --git a/crates/engine/tests/trim_closed_polyline.rs b/crates/engine/tests/it/trim_closed_polyline.rs
similarity index 100%
rename from crates/engine/tests/trim_closed_polyline.rs
rename to crates/engine/tests/it/trim_closed_polyline.rs
diff --git a/crates/engine/tests/trim_extend_options.rs b/crates/engine/tests/it/trim_extend_options.rs
similarity index 100%
rename from crates/engine/tests/trim_extend_options.rs
rename to crates/engine/tests/it/trim_extend_options.rs
diff --git a/crates/engine/tests/undo_count.rs b/crates/engine/tests/it/undo_count.rs
similarity index 100%
rename from crates/engine/tests/undo_count.rs
rename to crates/engine/tests/it/undo_count.rs
diff --git a/crates/engine/tests/undo_layout_tab.rs b/crates/engine/tests/it/undo_layout_tab.rs
similarity index 100%
rename from crates/engine/tests/undo_layout_tab.rs
rename to crates/engine/tests/it/undo_layout_tab.rs
diff --git a/crates/engine/tests/viewport_clip.rs b/crates/engine/tests/it/viewport_clip.rs
similarity index 100%
rename from crates/engine/tests/viewport_clip.rs
rename to crates/engine/tests/it/viewport_clip.rs
diff --git a/crates/engine/tests/vplayer_prompts.rs b/crates/engine/tests/it/vplayer_prompts.rs
similarity index 100%
rename from crates/engine/tests/vplayer_prompts.rs
rename to crates/engine/tests/it/vplayer_prompts.rs
diff --git a/crates/engine/tests/vports.rs b/crates/engine/tests/it/vports.rs
similarity index 100%
rename from crates/engine/tests/vports.rs
rename to crates/engine/tests/it/vports.rs
diff --git a/crates/engine/tests/xdata_follows_entity.rs b/crates/engine/tests/it/xdata_follows_entity.rs
similarity index 100%
rename from crates/engine/tests/xdata_follows_entity.rs
rename to crates/engine/tests/it/xdata_follows_entity.rs
diff --git a/crates/engine/tests/zoom_keywords.rs b/crates/engine/tests/it/zoom_keywords.rs
similarity index 100%
rename from crates/engine/tests/zoom_keywords.rs
rename to crates/engine/tests/it/zoom_keywords.rs
diff --git a/crates/engine/tests/zoom_viewport.rs b/crates/engine/tests/it/zoom_viewport.rs
similarity index 100%
rename from crates/engine/tests/zoom_viewport.rs
rename to crates/engine/tests/it/zoom_viewport.rs
diff --git a/crates/engine/tests/zoom_window_ortho.rs b/crates/engine/tests/it/zoom_window_ortho.rs
similarity index 100%
rename from crates/engine/tests/zoom_window_ortho.rs
rename to crates/engine/tests/it/zoom_window_ortho.rs
diff --git a/crates/fonts/build.rs b/crates/fonts/build.rs
index 7eb2a784b..6df86f7eb 100644
--- a/crates/fonts/build.rs
+++ b/crates/fonts/build.rs
@@ -18,9 +18,11 @@ fn main() {
         match craft_fonts(&dir) {
             Ok(entries) => src.push_str(&entries),
             Err(e) if std::env::var_os("CRAFT_FONTS_REQUIRED").is_some() => {
-                println!("cargo::error=CRAFT_FONTS_DIR={}: {e}", dir.display());
+                println!("cargo::error=CRAFT_FONTS_DIR={}: {}", one_line(&dir.display().to_string()), one_line(&e));
+            }
+            Err(e) => {
+                println!("cargo::warning=building without craft-fonts: CRAFT_FONTS_DIR={}: {}", one_line(&dir.display().to_string()), one_line(&e))
             }
-            Err(e) => println!("cargo::warning=building without craft-fonts: CRAFT_FONTS_DIR={}: {e}", dir.display()),
         }
     }
     src.push_str("];\n");
@@ -37,7 +39,9 @@ const BARRED_FAMILIES: [&str; 5] = ["Source Han", "Source Serif", "Source Sans",
 /// One `CraftFont { .. }` initialiser per manifest line, in manifest order.
 fn craft_fonts(dir: &std::path::Path) -> Result<String, String> {
     let manifest = dir.join("fonts/manifest.txt");
-    println!("cargo::rerun-if-changed={}", manifest.display());
+    rerun_if_changed(&manifest)?;
+    // Resolve the checkout root once so every manifest file can be confined inside it.
+    let root = dir.canonicalize().map_err(|e| format!("{}: {e}", dir.display()))?;
     let text = std::fs::read_to_string(&manifest).map_err(|e| format!("{}: {e}", manifest.display()))?;
     let wasm = std::env::var("CARGO_CFG_TARGET_ARCH").is_ok_and(|a| a == "wasm32");
     let mut out = String::new();
@@ -55,8 +59,8 @@ fn craft_fonts(dir: &std::path::Path) -> Result<String, String> {
         if wasm && !web_face {
             continue;
         }
-        let path = dir.join(file).canonicalize().map_err(|e| format!("{file}: {e}"))?;
-        println!("cargo::rerun-if-changed={}", path.display());
+        let path = resolve_font(&root, file)?;
+        rerun_if_changed(&path)?;
         let scripts: Vec<String> = scripts.split(',').map(|s| format!("{:?}", s.trim())).collect();
         let _ = writeln!(
             out,
@@ -67,3 +71,38 @@ fn craft_fonts(dir: &std::path::Path) -> Result<String, String> {
     }
     Ok(out)
 }
+
+/// Resolve a manifest `file` field to a real path *confined to the checkout* `root` (CWE-22).
+///
+/// The field is rejected if it is absolute or contains a parent (`..`) component, and the
+/// canonicalised result must still live inside `root`, so a crafted manifest or a symlink in the
+/// checkout cannot make the generated `include_bytes!` read an arbitrary file on the build host.
+fn resolve_font(root: &std::path::Path, file: &str) -> Result<PathBuf, String> {
+    let rel = std::path::Path::new(file);
+    if rel.is_absolute() || rel.components().any(|c| matches!(c, std::path::Component::ParentDir)) {
+        return Err(format!("{file}: manifest paths must be relative and stay inside the checkout"));
+    }
+    let path = root.join(rel).canonicalize().map_err(|e| format!("{file}: {e}"))?;
+    if !path.starts_with(root) {
+        return Err(format!("{file}: resolves outside the craft-fonts checkout"));
+    }
+    Ok(path)
+}
+
+/// Collapse CR/LF in a diagnostic derived from checkout contents to a single space, so it cannot
+/// introduce an additional Cargo directive on the newline-delimited build-script stream (CWE-74).
+fn one_line(s: &str) -> String {
+    s.replace(['\n', '\r'], " ")
+}
+
+/// Emit a `cargo::rerun-if-changed` directive for `path`, refusing paths that contain a line
+/// separator (CWE-74): Cargo's build-script protocol is newline-delimited, so a path with an
+/// embedded CR/LF could smuggle an extra directive such as `cargo::rustc-env=OUT_DIR=…`.
+fn rerun_if_changed(path: &std::path::Path) -> Result<(), String> {
+    let shown = path.display().to_string();
+    if shown.contains(['\n', '\r']) {
+        return Err(format!("{shown:?}: path contains a line separator"));
+    }
+    println!("cargo::rerun-if-changed={shown}");
+    Ok(())
+}
diff --git a/crates/fonts/src/complex.rs b/crates/fonts/src/complex.rs
index b479590e1..dafabdc7c 100644
--- a/crates/fonts/src/complex.rs
+++ b/crates/fonts/src/complex.rs
@@ -8,6 +8,7 @@
 
 use std::ops::Range;
 use std::panic::{AssertUnwindSafe, catch_unwind};
+use std::sync::Arc;
 
 use cadcraft_geom::Vec2;
 
@@ -60,6 +61,7 @@ pub(crate) fn shape(primary: Option<&Face>, s: &str, height: f64, width_factor:
     catch_unwind(AssertUnwindSafe(|| shape_chars(primary, &chars, height, width_factor, oblique))).ok()
 }
 
+/// Lay out decoded directional runs, keeping advances and decoration spans for empty glyphs.
 fn shape_chars(primary: Option<&Face>, chars: &[(char, bool, bool)], height: f64, width_factor: f64, oblique: f64) -> Shaped {
     let h = if height.is_finite() && height > 0.0 { height } else { 1.0 };
     let wf = if width_factor.is_finite() && width_factor.abs() > 1e-6 { width_factor } else { 1.0 };
@@ -68,6 +70,7 @@ fn shape_chars(primary: Option<&Face>, chars: &[(char, bool, bool)], height: f64
     let cs: Vec<char> = chars.iter().map(|c| c.0).collect();
     let flags = |i: usize| chars.get(i).map(|c| (c.1, c.2)).unwrap_or((false, false));
     let mut out = Shaped::default();
+    let mut points_left = ttf::MAX_SHAPED_POINTS;
     let mut spans: Vec<(f64, f64, bool, bool)> = Vec::new();
     let mut x = 0.0;
     // Whether the rightmost glyph so far is a stroke-font glyph.
@@ -102,11 +105,10 @@ fn shape_chars(primary: Option<&Face>, chars: &[(char, bool, bool)], height: f64
                         let outline = ttf::glyph_by_id(face, g.gid);
                         let k = h / outline.cap * wf;
                         let dy = g.dy * h / outline.cap;
-                        let mut contours = ttf::place_glyph(&outline, x + g.dx * k, h, wf, shear);
-                        for p in contours.iter_mut().flatten() {
-                            *p += Vec2::new(dy * shear, dy);
-                        }
-                        if !contours.is_empty() {
+                        if let Some(mut contours) = ttf::place_glyph_budgeted(&outline, x + g.dx * k, h, wf, shear, &mut points_left) {
+                            for p in contours.iter_mut().flatten() {
+                                *p += Vec2::new(dy * shear, dy);
+                            }
                             out.glyphs.push(contours);
                         }
                         let adv = g.advance * k;
@@ -181,28 +183,31 @@ struct Glyph {
 /// Shape characters `r` of `cs` (one direction, one face) into glyphs in display order.
 fn shape_run(face: &Face, cs: &[char], r: Range<usize>, rtl: bool) -> Vec<Glyph> {
     let run = cs.get(r.clone()).unwrap_or_default();
-    let Ok(font) = harfrust::FontRef::from_index(&face.bytes, face.index) else { return Vec::new() };
-    let data = harfrust::ShaperData::new(&font);
-    let shaper = data.shaper(&font).build();
-    let mut buf = harfrust::UnicodeBuffer::new();
+    // Shares the face's bytes instead of copying them.
+    let bytes: Arc<dyn AsRef<[u8]> + Send + Sync> = face.bytes.clone();
+    let Some(font) = harfrust::Font::new(bytes, face.index) else { return Vec::new() };
+    let shaper = harfrust::ShaperFont::new(&font);
+    let mut buf = harfrust::Buffer::new();
     let arabic = run.iter().any(|c| matches!(*c, '\u{0600}'..='\u{08FF}'));
     if arabic && !face.has_joining_features() {
         for (c, i) in bidi::presentation_forms(run, |p| face.has_glyph(p)) {
-            buf.add(c, u32::try_from(r.start + i).unwrap_or(u32::MAX));
+            buf.push(u32::from(c), u32::try_from(r.start + i).unwrap_or(u32::MAX));
         }
     } else {
         for (i, c) in run.iter().enumerate() {
-            buf.add(*c, u32::try_from(r.start + i).unwrap_or(u32::MAX));
+            buf.push(u32::from(*c), u32::try_from(r.start + i).unwrap_or(u32::MAX));
         }
     }
     buf.set_direction(if rtl { harfrust::Direction::RightToLeft } else { harfrust::Direction::LeftToRight });
     buf.guess_segment_properties();
-    let shaped = shaper.shape(buf, harfrust::ShapeOptions::new());
-    let k = 1000.0 / f64::from(shaper.units_per_em().max(1));
-    shaped
-        .glyph_infos()
+    // Without a plan, shaping fails only on an already shaped buffer or an unset direction.
+    if harfrust::shape(&shaper, &mut buf, harfrust::ShapeOptions::new()).is_err() {
+        return Vec::new();
+    }
+    let k = 1000.0 / f64::from(font.units_per_em().max(1));
+    buf.glyph_infos()
         .iter()
-        .zip(shaped.glyph_positions())
+        .zip(buf.glyph_positions())
         .map(|(gi, gp)| Glyph {
             gid: gi.glyph_id,
             cluster: usize::try_from(gi.cluster).unwrap_or(usize::MAX),
@@ -290,6 +295,32 @@ mod tests {
         assert!((crate::line_width("قیمت 25 تومان", 1.0, 1.0) - sh.width).abs() < 1e-9);
     }
 
+    #[test]
+    fn devanagari_run_is_reordered_with_line_clusters_and_advances_per_1000_em() {
+        use skrifa::MetadataProvider;
+        use skrifa::instance::{LocationRef, Size};
+        let Some(face) = ttf::fallback_for('\u{0915}') else { return };
+        let Some(ka) = nominal(&face, '\u{0915}') else { return };
+        // "कि" after two other characters of the line: the vowel sign i is drawn before the
+        // consonant (Indic reordering, which needs the script the shaper guesses from the text),
+        // both glyphs carry the cluster of the consonant's index in the line, not in the run.
+        let cs: Vec<char> = "ab\u{0915}\u{093F}".chars().collect();
+        let gs = shape_run(&face, &cs, 2..4, false);
+        let gids: Vec<u32> = gs.iter().map(|g| g.gid).collect();
+        assert_eq!(gids.len(), 2, "{gids:?}");
+        assert!(gids.first() != Some(&ka) && gids.last() == Some(&ka), "vowel sign before ka: {gids:?}");
+        assert!(gs.iter().all(|g| g.cluster == 2), "{:?}", gs.iter().map(|g| g.cluster).collect::<Vec<_>>());
+        // Advances come out at 1000 units per em, whatever the font's own em. A font that is
+        // already at 1000 per em could not tell a missing scale apart, so it checks nothing here.
+        let Some(font) = face.font() else { return };
+        if font.metrics(Size::unscaled(), LocationRef::default()).units_per_em == 1000 {
+            return;
+        }
+        let hmtx = font.glyph_metrics(Size::new(1000.0), LocationRef::default()).advance_width(skrifa::GlyphId::new(ka));
+        let adv = gs.last().map(|g| g.advance);
+        assert!(matches!((adv, hmtx), (Some(a), Some(h)) if (a - f64::from(h)).abs() < 1e-3), "{adv:?} vs {hmtx:?}");
+    }
+
     #[test]
     fn hostile_rtl_lines_never_panic() {
         for s in ["\u{202E}%%u\u{05D0}%%", "\u{2067}\u{0644}\u{0627}\u{2069}%%o", "\u{064E}\u{064E}\u{05D0}", "\u{05D0}\u{E000}\u{10FFFF}"] {
diff --git a/crates/fonts/src/lib.rs b/crates/fonts/src/lib.rs
index 3f86f817c..13af05646 100644
--- a/crates/fonts/src/lib.rs
+++ b/crates/fonts/src/lib.rs
@@ -334,7 +334,11 @@ pub struct TextGlyph {
 
 impl Shaped {
     /// Add a glyph outline and, when it is a font glyph, its [`TextGlyph`].
+    /// An empty outline is retained only when text metadata needs its slot.
     pub(crate) fn push_glyph(&mut self, contours: Vec<Vec<Vec2>>, text: Option<TextGlyph>) {
+        if contours.is_empty() && text.is_none() {
+            return;
+        }
         if let Some(t) = text {
             self.text.push(TextGlyph { outline: self.glyphs.len(), ..t });
         }
diff --git a/crates/fonts/src/mtext.rs b/crates/fonts/src/mtext.rs
index 1d53dc915..0c6cb074c 100644
--- a/crates/fonts/src/mtext.rs
+++ b/crates/fonts/src/mtext.rs
@@ -501,6 +501,9 @@ struct Line {
     width: f64,
     max_h: f64,
     text: String,
+    /// Running character count of `text`, kept incrementally so appending a segment need not
+    /// rescan the whole accumulated line (which is multiplicative on a long line) (CWE-407).
+    chars: usize,
     /// Index of the paragraph the line belongs to.
     para: usize,
 }
@@ -580,9 +583,10 @@ pub fn layout_mtext_with(contents: &str, p: &MTextParams) -> MTextLayout {
                     finish(&mut lines, &mut line, fmt(last_fmt), para);
                 } else if !line.items.is_empty() || pending_space.is_some() {
                     if let Some(f) = pending_space {
-                        let at = line.text.chars().count();
+                        let at = line.chars;
                         line.items.push(Item { seg: None, fmt: f, x: line.width, w: sw, at });
                         line.text.push(' ');
+                        line.chars += 1;
                     }
                     line.width += sw;
                 }
@@ -590,8 +594,10 @@ pub fn layout_mtext_with(contents: &str, p: &MTextParams) -> MTextLayout {
                 for (sg, f) in segs {
                     let fw = seg_width(sg, fmt(*f));
                     line.max_h = line.max_h.max(fmt(*f).height);
-                    let at = line.text.chars().count();
-                    line.text.push_str(&seg_plain(sg));
+                    let at = line.chars;
+                    let plain = seg_plain(sg);
+                    line.chars += plain.chars().count();
+                    line.text.push_str(&plain);
                     line.items.push(Item { seg: Some(sg.clone()), fmt: *f, x: line.width, w: fw, at });
                     line.width += fw;
                     last_fmt = *f;
@@ -679,6 +685,16 @@ pub fn layout_mtext_with(contents: &str, p: &MTextParams) -> MTextLayout {
 mod tests {
     use super::*;
 
+    /// Incremental character accounting preserves the text of a multi-word line without introducing wrapping.
+    #[test]
+    fn line_char_offsets_track_incrementally() {
+        // A multi-word line lays out correctly even though the per-line character count is now
+        // maintained incrementally rather than rescanned per segment (CWE-407, row 20).
+        let l = layout_mtext("alpha beta gamma", Vec2::ZERO, 1.0, 0.0, 1, 0.0, 1.0);
+        assert_eq!(l.lines.len(), 1, "no wrap width: one line");
+        assert_eq!(l.lines[0], "alpha beta gamma");
+    }
+
     #[test]
     fn strips_formatting() {
         assert_eq!(plain_mtext("{\\fArial|b1;Bold}\\Pline 2"), "Bold\nline 2");
diff --git a/crates/fonts/src/ttf.rs b/crates/fonts/src/ttf.rs
index 62759c1b0..52998900c 100644
--- a/crates/fonts/src/ttf.rs
+++ b/crates/fonts/src/ttf.rs
@@ -107,6 +107,9 @@ const MAX_FIRST_WORD_FILES: usize = 24;
 const MAX_LOADED_BYTES: usize = 256 << 20;
 const MAX_CACHED_NAMES: usize = 4096;
 const MAX_CACHED_CHARS: usize = 50_000;
+/// Cumulative outline points one shaped line may retain, so an oversized expanded glyph repeated
+/// across a string cannot grow the result without bound (CWE-400).
+pub(crate) const MAX_SHAPED_POINTS: usize = 8_000_000;
 
 /// Fonts known to cover many scripts (CJK first), tried first for missing glyphs. Matched as
 /// substrings of the normalised file stem.
@@ -595,6 +598,7 @@ pub fn fallback_for(c: char) -> Option<Face> {
 #[derive(Default)]
 pub(crate) struct GlyphOutline {
     pub(crate) contours: Arc<[Vec<Vec2>]>,
+    points: usize,
     pub(crate) advance: f64,
     pub(crate) cap: f64,
     /// The font maps the character (false: the missing-glyph shape).
@@ -614,33 +618,62 @@ enum GlyphKey {
 /// Cached glyph outlines keyed by (font bytes address, length, face, glyph). Fonts live for the
 /// whole process in the font table, so the address identifies them. A read-write lock: display
 /// lists are built on all cores and nearly every lookup is a hit, which a mutex serialized.
-type GlyphCache = HashMap<(usize, usize, u32, GlyphKey), Arc<GlyphOutline>>;
+#[derive(Default)]
+struct GlyphCache {
+    glyphs: HashMap<(usize, usize, u32, GlyphKey), Arc<GlyphOutline>>,
+    points: usize,
+}
 
+/// Return the process-wide outline cache whose retained glyph and point counts are bounded during insertion.
 fn glyph_cache() -> &'static RwLock<GlyphCache> {
     static C: OnceLock<RwLock<GlyphCache>> = OnceLock::new();
-    C.get_or_init(|| RwLock::new(HashMap::new()))
+    C.get_or_init(|| RwLock::new(GlyphCache::default()))
 }
 
 const MAX_CACHED_GLYPHS: usize = 40_000;
 const UPEM: f32 = 1000.0;
 
+#[derive(Default)]
 struct Pen {
     contours: Vec<Vec<Vec2>>,
     cur: Vec<Vec2>,
+    points: usize,
+    truncated: bool,
 }
 
+const MAX_OUTLINE_POINTS: usize = 65_536;
+
 impl Pen {
+    /// Append one flattened outline point, discarding all contours if the per-glyph point limit is exceeded.
+    fn push(&mut self, point: Vec2) {
+        if self.truncated {
+            return;
+        }
+        if self.points == MAX_OUTLINE_POINTS {
+            // An incomplete contour is not safe to fill; retain only the advance for this glyph.
+            self.truncated = true;
+            self.cur.clear();
+            self.contours.clear();
+            return;
+        }
+        self.points += 1;
+        self.cur.push(point);
+    }
+
     fn pt(x: f32, y: f32) -> Vec2 {
         Vec2::new(f64::from(x), f64::from(y))
     }
+    /// Close and retain a nondegenerate contour only if its closing point also fits the outline budget.
     fn flush(&mut self) {
         if self.cur.len() > 2 {
             if let (Some(f), Some(l)) = (self.cur.first().copied(), self.cur.last().copied())
                 && f != l
             {
-                self.cur.push(f);
+                self.push(f);
+            }
+            if !self.truncated {
+                self.contours.push(std::mem::take(&mut self.cur));
             }
-            self.contours.push(std::mem::take(&mut self.cur));
         } else {
             self.cur.clear();
         }
@@ -648,13 +681,16 @@ impl Pen {
 }
 
 impl OutlinePen for Pen {
+    /// Finish the preceding contour and begin a new one through the budgeted point writer.
     fn move_to(&mut self, x: f32, y: f32) {
         self.flush();
-        self.cur.push(Self::pt(x, y));
+        self.push(Self::pt(x, y));
     }
+    /// Append a line endpoint through the budgeted point writer.
     fn line_to(&mut self, x: f32, y: f32) {
-        self.cur.push(Self::pt(x, y));
+        self.push(Self::pt(x, y));
     }
+    /// Flatten a quadratic segment into six samples, charging each retained point to the glyph budget.
     fn quad_to(&mut self, cx0: f32, cy0: f32, x: f32, y: f32) {
         let a = self.cur.last().copied().unwrap_or_default();
         let c = Self::pt(cx0, cy0);
@@ -662,9 +698,10 @@ impl OutlinePen for Pen {
         for i in 1..=6 {
             let t = f64::from(i) / 6.0;
             let u = 1.0 - t;
-            self.cur.push(a * (u * u) + c * (2.0 * u * t) + b * (t * t));
+            self.push(a * (u * u) + c * (2.0 * u * t) + b * (t * t));
         }
     }
+    /// Flatten a cubic segment into eight samples, charging each retained point to the glyph budget.
     fn curve_to(&mut self, cx0: f32, cy0: f32, cx1: f32, cy1: f32, x: f32, y: f32) {
         let a = self.cur.last().copied().unwrap_or_default();
         let c0 = Self::pt(cx0, cy0);
@@ -673,7 +710,7 @@ impl OutlinePen for Pen {
         for i in 1..=8 {
             let t = f64::from(i) / 8.0;
             let u = 1.0 - t;
-            self.cur.push(a * (u * u * u) + c0 * (3.0 * u * u * t) + c1 * (3.0 * u * t * t) + b * (t * t * t));
+            self.push(a * (u * u * u) + c0 * (3.0 * u * u * t) + c1 * (3.0 * u * t * t) + b * (t * t * t));
         }
     }
     fn close(&mut self) {
@@ -712,9 +749,11 @@ pub fn glyph_contours(face: &Face, gid: u16) -> Arc<[Vec<Vec2>]> {
     glyph_by_id(face, u32::from(gid)).contours.clone()
 }
 
+/// Load or build a glyph outline with bounded flattening, retaining its advance even when contours are discarded.
+/// Cache insertion clears existing entries when the glyph-count or aggregate point allowance would be exceeded.
 fn outline(face: &Face, k: GlyphKey) -> Arc<GlyphOutline> {
     let key = (face.bytes.as_ptr() as usize, face.bytes.len(), face.index, k);
-    if let Some(g) = glyph_cache().read().unwrap_or_else(PoisonError::into_inner).get(&key) {
+    if let Some(g) = glyph_cache().read().unwrap_or_else(PoisonError::into_inner).glyphs.get(&key) {
         return g.clone();
     }
     let Some(f) = face.font() else { return Arc::new(GlyphOutline { cap: 1.0, ..Default::default() }) };
@@ -723,19 +762,24 @@ fn outline(face: &Face, k: GlyphKey) -> Arc<GlyphOutline> {
         GlyphKey::Id(id) => Some(GlyphId::new(id)),
     };
     let gid = mapped.unwrap_or_default();
-    let mut pen = Pen { contours: Vec::new(), cur: Vec::new() };
+    let mut pen = Pen::default();
     if let Some(g) = f.outline_glyphs().get(gid) {
         let _ = g.draw(DrawSettings::unhinted(Size::new(UPEM), LocationRef::default()), &mut pen);
         pen.flush();
     }
     let advance = f64::from(f.glyph_metrics(Size::new(UPEM), LocationRef::default()).advance_width(gid).unwrap_or(UPEM * 0.5));
     let (cap, mapped, gid) = (cap_height(&f), mapped.is_some(), gid.to_u32());
-    let g = Arc::new(GlyphOutline { contours: pen.contours.into(), advance, cap, mapped, gid, face: Some(face.clone()) });
+    let points = pen.contours.iter().map(Vec::len).sum();
+    let g = Arc::new(GlyphOutline { points, contours: pen.contours.into(), advance, cap, mapped, gid, face: Some(face.clone()) });
     let mut cache = glyph_cache().write().unwrap_or_else(PoisonError::into_inner);
-    if cache.len() > MAX_CACHED_GLYPHS {
-        cache.clear();
+    if cache.glyphs.len() >= MAX_CACHED_GLYPHS || cache.points.saturating_add(points) > MAX_SHAPED_POINTS {
+        cache.glyphs.clear();
+        cache.points = 0;
     }
-    cache.insert(key, g.clone());
+    if let Some(old) = cache.glyphs.insert(key, g.clone()) {
+        cache.points -= old.points;
+    }
+    cache.points += points;
     g
 }
 
@@ -777,6 +821,13 @@ pub(crate) fn text_glyph_at(g: &GlyphOutline, c: char, origin: Vec2, scale: f64,
     })
 }
 
+/// Charge source outline points before copying and transforming a glyph.
+/// Return `None` without spending fuel when it cannot fit; empty outlines remain valid at zero budget.
+pub(crate) fn place_glyph_budgeted(g: &GlyphOutline, x: f64, h: f64, wf: f64, shear: f64, points_left: &mut usize) -> Option<Vec<Vec<Vec2>>> {
+    *points_left = points_left.checked_sub(g.points)?;
+    Some(place_glyph(g, x, h, wf, shear))
+}
+
 /// Contours of a glyph scaled so its font's cap height is `h`, at pen position `x`.
 pub(crate) fn place_glyph(g: &GlyphOutline, x: f64, h: f64, wf: f64, shear: f64) -> Vec<Vec<Vec2>> {
     place_glyph_at(g, Vec2::new(x, 0.0), h / g.cap, wf, shear)
@@ -814,16 +865,20 @@ pub fn shape(face: &Face, s: &str, height: f64, width_factor: f64, oblique: f64)
     let mut out = Shaped::default();
     let mut spans = Vec::new();
     let mut x = 0.0;
+    // Cumulative retained-point budget: a compact CFF/OTF font can expand one glyph into a huge
+    // outline, and a short repeated string copies it per occurrence, so cap the total geometry
+    // kept in the Shaped result (CWE-400). Advances still accumulate so the width stays sensible.
+    let mut points_left: usize = MAX_SHAPED_POINTS;
     for (c, under, over) in crate::decode_controls(s) {
         if crate::bidi::is_format_control(c) {
             continue;
         }
         let g = glyph_or_fallback(face, c);
-        if !c.is_whitespace() {
-            let contours = place_glyph(&g, x, h, wf, shear);
-            if !contours.is_empty() {
-                out.push_glyph(contours, text_glyph(&g, c, x, h, wf, shear));
-            }
+        if !c.is_whitespace()
+            && let Some(contours) = place_glyph_budgeted(&g, x, h, wf, shear, &mut points_left)
+        {
+            // Even an empty mapped glyph needs a valid outline slot for text export.
+            out.push_glyph(contours, text_glyph(&g, c, x, h, wf, shear));
         }
         let adv = g.advance * h / g.cap * wf;
         spans.push((x, x + adv, under, over));
@@ -878,3 +933,69 @@ mod family_tests {
         assert!(family_candidates(&many, "gosttypea", "gost").len() <= MAX_FAMILY_FILES + MAX_FIRST_WORD_FILES);
     }
 }
+
+#[cfg(test)]
+mod geometry_budget_tests {
+    use super::*;
+    /// Placement checks the source point cost before copying and accepts empty outlines without spending points.
+    #[test]
+    fn placement_checks_source_size_and_accepts_empty_glyphs() {
+        let glyph = GlyphOutline { contours: vec![vec![Vec2::ZERO; 4]].into(), points: 4, cap: 1.0, ..Default::default() };
+        let mut budget = 3;
+        assert!(place_glyph_budgeted(&glyph, 0.0, 1.0, 1.0, 0.0, &mut budget).is_none());
+        assert_eq!(budget, 3);
+        let empty = GlyphOutline { cap: 1.0, ..Default::default() };
+        assert_eq!(place_glyph_budgeted(&empty, 0.0, 1.0, 1.0, 0.0, &mut 0), Some(Vec::new()));
+        let mut budget = 4;
+        assert!(place_glyph_budgeted(&glyph, 0.0, 1.0, 1.0, 0.0, &mut budget).is_some());
+        assert_eq!(budget, 0);
+        assert!(place_glyph_budgeted(&glyph, 0.0, 1.0, 1.0, 0.0, &mut budget).is_none());
+    }
+    /// Exceeding the per-glyph flattening limit discards all contour geometry before it reaches the cache.
+    #[test]
+    fn flattened_outlines_are_bounded_before_caching() {
+        let mut pen = Pen::default();
+        for _ in 0..MAX_OUTLINE_POINTS {
+            pen.line_to(0.0, 0.0);
+        }
+        pen.line_to(1.0, 1.0);
+        pen.close();
+        assert!(pen.truncated);
+        assert!(pen.contours.is_empty() && pen.cur.is_empty());
+        assert_eq!(pen.points, MAX_OUTLINE_POINTS);
+    }
+    /// A mapped empty glyph retains text metadata referring to an existing empty outline slot.
+    #[test]
+    fn mapped_empty_glyph_keeps_text_and_a_valid_outline_slot() {
+        // Metadata placement does not parse the face; an empty face suffices to check the index contract.
+        let glyph = GlyphOutline { cap: 1.0, mapped: true, gid: 1, face: Some(Face { bytes: Arc::new(Vec::new()), index: 0 }), ..Default::default() };
+        let contours = place_glyph_budgeted(&glyph, 0.0, 1.0, 1.0, 0.0, &mut 0).unwrap();
+        let mut shaped = Shaped::default();
+        shaped.push_glyph(contours, text_glyph(&glyph, 'x', 0.0, 1.0, 1.0, 0.0));
+        assert_eq!(shaped.text.len(), 1);
+        assert_eq!(shaped.text[0].outline, 0);
+        assert!(shaped.glyphs[shaped.text[0].outline].is_empty());
+    }
+
+    /// An empty glyph with no text mapping leaves the shaped result empty.
+    #[test]
+    fn unmapped_empty_glyph_does_not_make_the_shape_nonempty() {
+        let glyph = GlyphOutline { cap: 1.0, ..Default::default() };
+        let contours = place_glyph_budgeted(&glyph, 0.0, 1.0, 1.0, 0.0, &mut 0).unwrap();
+        let mut shaped = Shaped::default();
+        shaped.push_glyph(contours, text_glyph(&glyph, 'x', 0.0, 1.0, 1.0, 0.0));
+        assert!(shaped.is_empty());
+        assert!(shaped.text.is_empty());
+    }
+
+    /// Missing text metadata does not discard a glyph that has drawable contours.
+    #[test]
+    fn an_unmapped_glyph_with_contours_still_draws() {
+        let mut shaped = Shaped::default();
+        let contours = vec![vec![Vec2::ZERO, Vec2::new(1.0, 1.0)]];
+        shaped.push_glyph(contours.clone(), None);
+        assert!(!shaped.is_empty());
+        assert_eq!(shaped.glyphs, vec![contours]);
+        assert!(shaped.text.is_empty());
+    }
+}
diff --git a/crates/geom/src/curve.rs b/crates/geom/src/curve.rs
index f0e783f55..72fe3ac0c 100644
--- a/crates/geom/src/curve.rs
+++ b/crates/geom/src/curve.rs
@@ -437,6 +437,10 @@ pub fn bulge_to_arc(a: Vec2, b: Vec2, bulge: f64) -> Option<(Arc, bool)> {
         return None;
     }
     let theta = 4.0 * bulge.atan(); // signed included angle
+    // A sweep at or below EPS would be read back as a full circle by `ccw_sweep`; it is a straight segment.
+    if theta.abs() <= EPS {
+        return None;
+    }
     let chord = a.dist(b);
     let r = chord / (2.0 * (theta / 2.0).sin().abs());
     let mid = a.mid(b);
diff --git a/crates/geom/src/fillet.rs b/crates/geom/src/fillet.rs
index abfea035b..d31757f79 100644
--- a/crates/geom/src/fillet.rs
+++ b/crates/geom/src/fillet.rs
@@ -158,7 +158,7 @@ fn seg_cross(a0: Vec2, a1: Vec2, b0: Vec2, b1: Vec2) -> Option<(f64, f64)> {
 }
 
 /// Crossings of two sampled polylines, as parameter seeds, with chunked box culling.
-fn crossings(a: &[(f64, Vec2)], b: &[(f64, Vec2)], out: &mut Vec<(f64, f64)>) {
+fn crossings(a: &[(f64, Vec2)], b: &[(f64, Vec2)], out: &mut Vec<(f64, f64)>, work: &mut usize) {
     const CHUNK: usize = 16;
     let boxes = |s: &[(f64, Vec2)]| -> Vec<(usize, Bounds2)> {
         (0..s.len().saturating_sub(1))
@@ -169,12 +169,16 @@ fn crossings(a: &[(f64, Vec2)], b: &[(f64, Vec2)], out: &mut Vec<(f64, f64)>) {
     let (ba, bb) = (boxes(a), boxes(b));
     for (ia, xa) in &ba {
         for (ib, xb) in &bb {
+            let Some(left) = work.checked_sub(1) else { return };
+            *work = left;
             if !xa.intersects(xb) {
                 continue;
             }
             for i in *ia..(*ia + CHUNK).min(a.len().saturating_sub(1)) {
                 let (Some(&(ta0, a0)), Some(&(ta1, a1))) = (a.get(i), a.get(i + 1)) else { continue };
                 for j in *ib..(*ib + CHUNK).min(b.len().saturating_sub(1)) {
+                    let Some(left) = work.checked_sub(1) else { return };
+                    *work = left;
                     let (Some(&(tb0, b0)), Some(&(tb1, b1))) = (b.get(j), b.get(j + 1)) else { continue };
                     if let Some((u, v)) = seg_cross(a0, a1, b0, b1) {
                         out.push((ta0 + (ta1 - ta0) * u, tb0 + (tb1 - tb0) * v));
@@ -255,24 +259,35 @@ pub fn tangent_circles(c1: &TanCurve, c2: &TanCurve, r: f64, near: &[Vec2]) -> V
     let (Some(r1), Some(r2)) = (c1.range(&win), c2.range(&win)) else { return Vec::new() };
     let signs: &[(f64, f64)] = if r > 0.0 { &[(1.0, 1.0), (1.0, -1.0), (-1.0, 1.0), (-1.0, -1.0)] } else { &[(0.0, 0.0)] };
     let mut out: Vec<CornerFit> = Vec::new();
+    let mut work = 16_000_000usize;
     for (s1, s2) in signs {
         let (d1, d2) = (s1 * r, s2 * r);
         let (o1, o2) = (sample(c1, &r1, d1), sample(c2, &r2, d2));
-        let mut seeds = Vec::new();
+        // Refine each pair before visiting the next: raw duplicate seeds in an early run must
+        // not consume all candidate slots. A separate request-wide budget bounds actual work.
         for a in &o1 {
             for b in &o2 {
-                crossings(a, b, &mut seeds);
-            }
-        }
-        for seed in seeds {
-            let Some((t1, t2)) = refine(c1, &r1, d1, c2, &r2, d2, seed, tol) else { continue };
-            let (Some(center), p1, p2) = (c1.offset(t1, d1), c1.point(t1), c2.point(t2)) else { continue };
-            let near_dup = |f: &CornerFit| f.center.near(center, tol * 1e3) && f.p1.near(p1, tol * 1e3) && f.p2.near(p2, tol * 1e3);
-            if !out.iter().any(near_dup) {
-                out.push(CornerFit { t1, t2, p1, p2, center });
-            }
-            if out.len() >= MAX_SOLUTIONS {
-                return out;
+                let mut seeds = Vec::new();
+                crossings(a, b, &mut seeds, &mut work);
+                seeds.sort_by(|x, y| x.0.total_cmp(&y.0).then(x.1.total_cmp(&y.1)));
+                seeds.dedup_by(|x, y| (x.0 - y.0).abs() < 1e-9 && (x.1 - y.1).abs() < 1e-9);
+                for seed in seeds {
+                    // Newton refinement has a fixed iteration cap and several curve evaluations.
+                    let Some(left) = work.checked_sub(128) else { return out };
+                    work = left;
+                    let Some((t1, t2)) = refine(c1, &r1, d1, c2, &r2, d2, seed, tol) else { continue };
+                    let (Some(center), p1, p2) = (c1.offset(t1, d1), c1.point(t1), c2.point(t2)) else { continue };
+                    let near_dup = |f: &CornerFit| f.center.near(center, tol * 1e3) && f.p1.near(p1, tol * 1e3) && f.p2.near(p2, tol * 1e3);
+                    if !out.iter().any(near_dup) {
+                        out.push(CornerFit { t1, t2, p1, p2, center });
+                    }
+                    if out.len() >= MAX_SOLUTIONS {
+                        return out;
+                    }
+                }
+                if work == 0 {
+                    return out;
+                }
             }
         }
     }
@@ -353,3 +368,18 @@ mod tests {
         assert!(tangent_circles(&bad, &s, 1.0, &[]).is_empty());
     }
 }
+
+#[cfg(test)]
+mod seed_budget_tests {
+    use super::*;
+    #[test]
+    fn crossing_visits_have_an_independent_work_limit() {
+        let a = [(0.0, Vec2::new(0.0, 0.0)), (1.0, Vec2::new(1.0, 1.0))];
+        let b = [(0.0, Vec2::new(0.0, 1.0)), (1.0, Vec2::new(1.0, 0.0))];
+        let mut seeds = Vec::new();
+        crossings(&a, &b, &mut seeds, &mut 0);
+        assert!(seeds.is_empty());
+        crossings(&a, &b, &mut seeds, &mut 10);
+        assert_eq!(seeds, vec![(0.5, 0.5)]);
+    }
+}
diff --git a/crates/geom/src/lib.rs b/crates/geom/src/lib.rs
index 8d305f79d..e62f478fb 100644
--- a/crates/geom/src/lib.rs
+++ b/crates/geom/src/lib.rs
@@ -25,7 +25,7 @@ pub use curve::{
 pub use fillet::{CornerFit, TanCurve, tangent_circles};
 pub use intersect::{circle_circle, intersect_ext, intersect_segments, line_circle, line_line, line_line_infinite};
 pub use mat::{Mat3, Mat4};
-pub use spline::Spline;
+pub use spline::{MAX_DEGREE as MAX_SPLINE_DEGREE, Spline};
 pub use spline_fit::{FitOptions, KnotParam};
 pub use vec::{Vec2, Vec3};
 
diff --git a/crates/geom/src/nurbs.rs b/crates/geom/src/nurbs.rs
index b5e1e866b..5268203b1 100644
--- a/crates/geom/src/nurbs.rs
+++ b/crates/geom/src/nurbs.rs
@@ -124,8 +124,15 @@ impl Spline {
         if !self.is_valid() {
             return Vec2::ZERO;
         }
+        self.derivative_unchecked(t)
+    }
+
+    /// First derivative without re-validating the spline. The caller must have confirmed
+    /// [`Spline::is_valid`] already; integration calls this once per sample, and re-running the
+    /// O(knots) validity scan each time would make measuring a valid spline quadratic (CWE-407).
+    fn derivative_unchecked(&self, t: f64) -> Vec2 {
         let p = self.degree;
-        let n = self.control.len() - 1;
+        let Some(n) = self.control.len().checked_sub(1) else { return Vec2::ZERO };
         let (lo, hi) = self.domain();
         let t = if t.is_finite() { t.clamp(lo, hi) } else { lo };
         let span = find_span(n, p, t, &self.knots);
@@ -470,9 +477,11 @@ impl Spline {
         out
     }
 
-    /// Arc length of one integration panel.
+    /// Arc length of one integration panel. The spline is validated once by the public callers
+    /// ([`Spline::length_between`]/[`Spline::length`]) before any panel is measured, so the speed
+    /// closure uses the unchecked derivative to avoid re-scanning the knots per sample.
     fn panel_length(&self, a: f64, b: f64) -> f64 {
-        let speed = |t: f64| self.derivative(t).len();
+        let speed = |t: f64| self.derivative_unchecked(t).len();
         adaptive_gauss(a, b, gauss(a, b, speed), &speed, MAX_GAUSS_DEPTH)
     }
 
diff --git a/crates/geom/src/region.rs b/crates/geom/src/region.rs
index 70eca56d2..696a97de2 100644
--- a/crates/geom/src/region.rs
+++ b/crates/geom/src/region.rs
@@ -114,9 +114,19 @@ fn build(polys: &[Vec<Vec2>], tol: f64) -> Option<Graph> {
     }
     let mut splits: Vec<Vec<f64>> = vec![vec![0.0, 1.0]; n];
     let mut tested = std::collections::HashSet::new();
+    // Count every candidate-pair *visit*, including repeats of a pair that shares several grid
+    // cells, not only the distinct pairs actually tested. A long segment replicated across many
+    // cells makes the same pair reappear in each, so a budget on distinct pairs alone leaves the
+    // repeated hashing unbounded (CWE-407).
+    let mut visits: u64 = 0;
+    const MAX_PAIR_VISITS: u64 = 60_000_000;
     for list in grid.values() {
         for (k, &i) in list.iter().enumerate() {
             for &j in list.iter().skip(k + 1) {
+                visits += 1;
+                if visits > MAX_PAIR_VISITS {
+                    return None;
+                }
                 if i == j || !tested.insert((i.min(j), i.max(j))) {
                     continue;
                 }
diff --git a/crates/geom/src/spline.rs b/crates/geom/src/spline.rs
index aaca36c1b..8ae2b73eb 100644
--- a/crates/geom/src/spline.rs
+++ b/crates/geom/src/spline.rs
@@ -3,6 +3,12 @@ use serde::{Deserialize, Serialize};
 use crate::spline_fit::FitOptions;
 use crate::{Bounds2, Vec2};
 
+/// Largest B-spline degree treated as valid. Basis evaluation is O(degree²) per sample and
+/// tessellation takes O(degree) samples, so an unbounded degree (DXF/HATCH can declare up to
+/// 100 000) turns a tiny spline into billions of iterations (CWE-407). Real splines are low
+/// degree (AutoCAD caps at 11); above this a spline evaluates to its control polygon instead.
+pub const MAX_DEGREE: usize = 64;
+
 /// A (possibly rational) B-spline curve, DXF SPLINE style.
 #[derive(Clone, Debug, Default, PartialEq, Serialize, Deserialize)]
 pub struct Spline {
@@ -57,7 +63,11 @@ impl Spline {
 
     pub fn is_valid(&self) -> bool {
         let n = self.control.len();
-        n > self.degree && self.degree >= 1 && self.knots.len() == n + self.degree + 1 && self.knots.windows(2).all(|w| w.first() <= w.get(1))
+        n > self.degree
+            && self.degree >= 1
+            && self.degree <= MAX_DEGREE
+            && self.knots.len() == n + self.degree + 1
+            && self.knots.windows(2).all(|w| w.first() <= w.get(1))
     }
 
     pub fn domain(&self) -> (f64, f64) {
@@ -192,3 +202,29 @@ pub(crate) fn solve(mut a: Vec<Vec<f64>>, mut b: Vec<f64>) -> Option<Vec<f64>> {
     }
     Some(x)
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn a_huge_degree_spline_is_invalid_and_cheap_to_tessellate() {
+        // A HATCH/DXF spline edge can declare a very high degree with matching knots. Such a
+        // spline is treated as invalid, so eval/tessellate fall back to the control polygon
+        // instead of doing O(degree^2) work per sample (CWE-407, rows 18/28).
+        let degree = 50_000usize;
+        let control = vec![Vec2::ZERO; degree + 2];
+        let knots = clamped_uniform_knots(control.len(), degree);
+        let s = Spline { degree, knots, control: control.clone(), ..Spline::default() };
+        assert!(!s.is_valid(), "a degree-{degree} spline must be rejected as invalid");
+        // Returns the control polygon rather than sampling, so this is fast.
+        assert_eq!(s.tessellate(1e-3).len(), control.len());
+    }
+
+    #[test]
+    fn a_normal_low_degree_spline_is_valid() {
+        let s = Spline::from_control(vec![Vec2::new(0.0, 0.0), Vec2::new(1.0, 1.0), Vec2::new(2.0, 0.0), Vec2::new(3.0, 1.0)], 3);
+        assert!(s.is_valid());
+        assert!(s.tessellate(1e-3).len() > 4);
+    }
+}
diff --git a/crates/geom/src/spline_fit.rs b/crates/geom/src/spline_fit.rs
index 5f42a01ad..4abdc977c 100644
--- a/crates/geom/src/spline_fit.rs
+++ b/crates/geom/src/spline_fit.rs
@@ -172,8 +172,21 @@ impl Spline {
                         return true;
                     }
                 }
-                // Other writers use the parameters themselves as interior knots.
-                u.len() > 2 && u.iter().skip(1).take(u.len() - 2).all(|q| norm.iter().any(|k| close(*k, *q)))
+                // Other writers use the parameters themselves as interior knots. Both `u` and
+                // `norm` are ascending, so a single linear merge decides containment instead of
+                // re-scanning `norm` from the start for every parameter, which is quadratic on an
+                // otherwise valid spline (CWE-407).
+                if u.len() <= 2 {
+                    return false;
+                }
+                let interior = u.get(1..u.len() - 1).unwrap_or(&[]);
+                let mut j = 0usize;
+                interior.iter().all(|q| {
+                    while j < norm.len() && norm[j] < *q && !close(norm[j], *q) {
+                        j += 1;
+                    }
+                    norm.get(j).is_some_and(|k| close(*k, *q))
+                })
             })
             .unwrap_or(KnotParam::Chord)
     }
@@ -895,3 +908,17 @@ mod tests {
         assert!(s.fit_opts.start_tangent.is_some_and(|t| t.near(Vec2::Y, 1e-12)));
     }
 }
+
+#[cfg(test)]
+mod knot_boundary_tests {
+    use super::*;
+    #[test]
+    fn uniform_knots_skip_the_strict_lower_tolerance_boundary() {
+        let q = 2.0 / 3.0;
+        let mut s = Spline::from_control(vec![Vec2::ZERO; 5], 1);
+        s.fit = vec![Vec2::new(0.0, 0.0), Vec2::new(1.0, 0.0), Vec2::new(4.0, 0.0), Vec2::new(9.0, 0.0)];
+        s.knots = vec![0.0, 0.0, 1.0 / 3.0, q - 1e-6, q, 1.0, 1.0];
+        assert!(s.is_valid());
+        assert_eq!(s.infer_knot_param(), KnotParam::Uniform);
+    }
+}
diff --git a/crates/geom/src/tests.rs b/crates/geom/src/tests.rs
index dd7b806c8..8b8a0bad2 100644
--- a/crates/geom/src/tests.rs
+++ b/crates/geom/src/tests.rs
@@ -74,6 +74,16 @@ fn bulge_quarter_arc() {
     assert!(close(arc.sweep(), PI / 2.0));
 }
 
+#[test]
+fn tiny_bulge_is_not_a_full_circle() {
+    let a = Vec2::new(0.0, 0.0);
+    let b = Vec2::new(10.0, 0.0);
+    let p = Polyline { vertices: vec![PolyVertex::with_bulge(a, 1e-10), PolyVertex::new(b)], closed: false };
+    assert!((p.len() - 10.0).abs() < 1e-6, "len={}", p.len());
+    let bb = p.bounds();
+    assert!(bb.max.x < 10.001 && bb.max.y < 0.001 && bb.min.y > -0.001, "bounds={bb:?}");
+}
+
 #[test]
 fn polyline_area_and_length() {
     let p = Polyline::from_points(&[Vec2::new(0.0, 0.0), Vec2::new(4.0, 0.0), Vec2::new(4.0, 3.0), Vec2::new(0.0, 3.0)], true);
diff --git a/crates/io/Cargo.toml b/crates/io/Cargo.toml
index 84adfec4f..395ec4966 100644
--- a/crates/io/Cargo.toml
+++ b/crates/io/Cargo.toml
@@ -19,10 +19,10 @@ cadcraft-fonts = { workspace = true }
 thiserror = { workspace = true }
 serde_json = { workspace = true }
 serde = { workspace = true }
-miniz_oxide = "0.8"
+miniz_oxide = "0.9"
 quick-xml = { workspace = true }
 
 [dev-dependencies]
 # Reads CADCraft's DWG output as written (tests only; the same version as cadcraft-dwg's).
-acadrust = "0.6.4"
+acadrust = "0.6.5"
 tiny-skia = { workspace = true }
diff --git a/crates/io/src/dxf_image.rs b/crates/io/src/dxf_image.rs
index 1b16fe8d4..8f4685a21 100644
--- a/crates/io/src/dxf_image.rs
+++ b/crates/io/src/dxf_image.rs
@@ -141,26 +141,38 @@ pub(crate) fn resolve(secs: &[Section], d: &mut Drawing) {
     if by_image.is_empty() {
         return;
     }
-    fill(&mut d.model, &by_image);
+    // Aggregate budget on the image-definition strings copied into referring images, so an
+    // attacker cannot multiply a long path/name across many references into gigabytes (CWE-400).
+    const MAX_RESOLVED_STRING_BYTES: usize = 64 << 20;
+    let mut budget = MAX_RESOLVED_STRING_BYTES;
+    fill(&mut d.model, &by_image, &mut budget);
     for l in &mut d.layouts {
-        fill(&mut l.entities, &by_image);
+        fill(&mut l.entities, &by_image, &mut budget);
     }
     for b in d.blocks.values_mut() {
         if b.entities.iter().any(|e| matches!(e.kind, EntityKind::Image(_)) && by_image.contains_key(&e.handle)) {
-            fill(&mut Arc::make_mut(b).entities, &by_image);
+            fill(&mut Arc::make_mut(b).entities, &by_image, &mut budget);
         }
     }
 }
 
-fn fill(store: &mut EntityStore, by_image: &HashMap<Handle, &Def>) {
+/// Resolve image definitions under a shared copied-string budget.
+/// When strings no longer fit, keep applying pixel-size and resolution metadata.
+fn fill(store: &mut EntityStore, by_image: &HashMap<Handle, &Def>, budget: &mut usize) {
     let hs: Vec<Handle> =
         store.iter().filter(|e| matches!(e.kind, EntityKind::Image(_)) && by_image.contains_key(&e.handle)).map(|e| e.handle).collect();
     for h in hs {
         let Some(def) = by_image.get(&h) else { continue };
+        // Charge the bytes this copy adds; once the shared budget is spent, stop copying strings
+        // (geometry fields are still applied) so retained memory stays bounded.
+        let cost = def.path.len() + def.name.len();
+        let copy_strings = budget.checked_sub(cost).map(|left| *budget = left).is_some();
         store.modify(h, |e| {
             if let EntityKind::Image(i) = &mut e.kind {
-                i.path = def.path.clone();
-                i.name = def.name.clone();
+                if copy_strings {
+                    i.path = def.path.clone();
+                    i.name = def.name.clone();
+                }
                 if let Some(p) = def.pixel_size {
                     i.pixel_size = p;
                 }
@@ -215,6 +227,10 @@ pub(crate) fn plan<'a>(entities: impl Iterator<Item = &'a cadcraft_doc::Entity>,
     let mut p = Plan::default();
     let mut index: HashMap<(String, String), usize> = HashMap::new();
     let mut used: HashSet<String> = HashSet::new();
+    // Next suffix to try for each normalised base name, so allocating a unique name resumes where
+    // the previous collision left off instead of re-probing `_2, _3, …` from the start — otherwise
+    // many images sharing a base name make name allocation quadratic (CWE-407).
+    let mut next_suffix: HashMap<String, usize> = HashMap::new();
     for e in entities {
         let EntityKind::Image(i) = &e.kind else { continue };
         if p.by_entity.contains_key(&e.handle) {
@@ -227,11 +243,12 @@ pub(crate) fn plan<'a>(entities: impl Iterator<Item = &'a cadcraft_doc::Entity>,
                 // Dictionary keys are unique regardless of case.
                 let base = def_name(i);
                 let mut name = base.clone();
-                let mut n = 2usize;
+                let mut n = next_suffix.get(&key(&base)).copied().unwrap_or(2);
                 while !used.insert(key(&name)) {
                     name = format!("{base}_{n}");
                     n = n.saturating_add(1);
                 }
+                next_suffix.insert(key(&base), n);
                 p.defs.push(PlannedDef {
                     handle: next(),
                     name,
diff --git a/crates/io/src/dxf_raw.rs b/crates/io/src/dxf_raw.rs
index 05e88403b..129183ef6 100644
--- a/crates/io/src/dxf_raw.rs
+++ b/crates/io/src/dxf_raw.rs
@@ -51,8 +51,6 @@ const MAX_OBJECTS: usize = 1_000_000;
 const MAX_XDATA_GROUPS: usize = 16_384;
 /// Longest ownership chain followed.
 const MAX_DEPTH: usize = 64;
-/// Handles above this are not believed (hostile files); references to them are dropped.
-const MAX_HANDLE: u64 = 1 << 48;
 
 /// Record types that structure a file: never written as an entity of another type.
 const STRUCTURAL: &[&str] = &["", "SECTION", "ENDSEC", "EOF", "TABLE", "ENDTAB", "BLOCK", "ENDBLK", "SEQEND", "VERTEX", "ATTRIB", "CLASS"];
@@ -85,9 +83,10 @@ fn tag(r: &RawTag) -> Tag {
     Tag::new(r.code, value.unwrap_or_else(|| Value::Str(r.value.clone())))
 }
 
-/// A handle value we believe: hexadecimal, not null, not absurdly large.
+/// A handle value we believe: hexadecimal and not null. DXF handles are up to 16 hex digits and
+/// AutoCAD writes some above 2^48 (e.g. 0xDAD1…), so the whole 64-bit range is believed.
 fn handle(s: &str) -> Option<Handle> {
-    Handle::parse_hex(s).filter(|h| h.0 != 0 && h.0 <= MAX_HANDLE)
+    Handle::parse_hex(s).filter(|h| h.0 != 0)
 }
 
 /// Group codes whose values are handles of other objects (DXF Reference, group code ranges).
diff --git a/crates/io/src/dxf_read.rs b/crates/io/src/dxf_read.rs
index 92d803e17..bfd1ec0ad 100644
--- a/crates/io/src/dxf_read.rs
+++ b/crates/io/src/dxf_read.rs
@@ -245,6 +245,11 @@ fn mirror_text(t: &mut Text, align: Option<Vec3>, insert: Vec3) {
 
 /// Parse one entity record. POLYLINE/INSERT followers are handled by the caller.
 fn entity(kind: &str, tags: &[Tag]) -> Option<(Common, EntityKind)> {
+    entity_with_table_budget(kind, tags, &mut 4_000_000)
+}
+
+/// Parse one entity while charging materialized table cells to the caller's shared import budget.
+fn entity_with_table_budget(kind: &str, tags: &[Tag], table_cells_left: &mut usize) -> Option<(Common, EntityKind)> {
     // The paper-space viewport our writer adds (dxf_write::paper_view) stays implicit.
     if kind == "VIEWPORT" && crate::dxf_ext::is_paper_view(tags) {
         return None;
@@ -480,7 +485,7 @@ fn entity(kind: &str, tags: &[Tag]) -> Option<(Common, EntityKind)> {
             }
             k
         }
-        "ACAD_TABLE" => EntityKind::Table(acad_table(tags)),
+        "ACAD_TABLE" => EntityKind::Table(acad_table(tags, table_cells_left)),
         "VIEWPORT" => EntityKind::Viewport(Viewport {
             center: t.p(10),
             width: t.fd(40, 1.0),
@@ -525,7 +530,7 @@ fn entity(kind: &str, tags: &[Tag]) -> Option<(Common, EntityKind)> {
 
 /// An ACAD_TABLE entity: sizes, cell texts and merges (DXF Reference), plus CADCraft's
 /// title/header flags, text height and style name from xdata when present.
-fn acad_table(tags: &[Tag]) -> Table {
+fn acad_table(tags: &[Tag], table_cells_left: &mut usize) -> Table {
     const MAX_CELLS: usize = 1_000_000;
     let start = tags.iter().position(|x| x.code == 100 && x.str() == "AcDbTable").unwrap_or(0);
     let tail = tags.get(start..).unwrap_or(&[]);
@@ -540,6 +545,12 @@ fn acad_table(tags: &[Tag]) -> Table {
         rows = 0;
         cols = 0;
     }
+    // Charge before any cell vector is materialized, including discarded tables.
+    let count = rows.saturating_mul(cols);
+    match table_cells_left.checked_sub(count) {
+        Some(left) => *table_cells_left = left,
+        None => return Table { insert: T(tags).p(10), ..Table::default() },
+    }
     let size = |v: f64| if v.is_finite() && v > 0.0 { v } else { 0.27 };
     let mut row_heights: Vec<f64> = head.all_f(141).into_iter().take(rows).map(size).collect();
     row_heights.resize(rows, 0.27);
@@ -1098,7 +1109,13 @@ fn entity_extras(kind: &str, tags: &[Tag], h: Handle, k: &mut EntityKind, rx: &m
 
 /// Parse a run of entity records (ENTITIES section or a block's body) into entities. Records that
 /// can't be placed are counted in `skipped`.
-fn parse_entities(recs: &[(String, Vec<Tag>)], d: &mut Drawing, rx: &mut Rx, skipped: &mut usize) -> Vec<(Option<String>, bool, Entity)> {
+fn parse_entities(
+    recs: &[(String, Vec<Tag>)],
+    d: &mut Drawing,
+    rx: &mut Rx,
+    skipped: &mut usize,
+    table_cells_left: &mut usize,
+) -> Vec<(Option<String>, bool, Entity)> {
     let mut out = Vec::new();
     let mut i = 0;
     while let Some((kind, tags)) = recs.get(i) {
@@ -1106,7 +1123,7 @@ fn parse_entities(recs: &[(String, Vec<Tag>)], d: &mut Drawing, rx: &mut Rx, ski
         let owner = crate::dxf_ext::owner(tags);
         let paper = t.i(67) == Some(1);
         let handle = t.s(5).and_then(|h| Handle::parse_hex(&h));
-        let mut kindent = entity(kind, tags);
+        let mut kindent = entity_with_table_budget(kind, tags, table_cells_left);
         if let Some((c, _)) = kindent.as_mut()
             && let Some(n) = entity_plot_style(tags, rx)
         {
@@ -1382,6 +1399,7 @@ fn style_font(tags: &[Tag], file: String) -> String {
     }
 }
 
+/// Load symbol tables and resolve handle references, indexing layer names for case-insensitive updates.
 fn tables(tags: &[Tag], d: &mut Drawing, rx: &mut Rx) {
     let recs = records(tags);
     // STYLE handle → name, or the shape file of an unnamed shape style (linetype elements).
@@ -1420,12 +1438,16 @@ fn tables(tags: &[Tag], d: &mut Drawing, rx: &mut Rx) {
         }
     }
     let mut active_vport = false;
+    // Index of layers already appended, by lower-cased name, so each LAYER record updates or
+    // appends in O(1) instead of scanning the growing layer list — otherwise many distinct layer
+    // names make import quadratic (CWE-407).
+    let mut layer_index: HashMap<String, usize> = d.layers.iter().enumerate().map(|(i, l)| (l.name.to_ascii_lowercase(), i)).collect();
     for (kind, tg) in recs {
         let t = T(&tg);
         match kind.as_str() {
             "LAYER" => {
                 let name = t.s(2).unwrap_or_default();
-                if name.is_empty() {
+                if name.is_empty() || d.layers.len() >= MAX_OBJECTS {
                     continue;
                 }
                 let aci = t.i(62).unwrap_or(7);
@@ -1455,14 +1477,21 @@ fn tables(tags: &[Tag], d: &mut Drawing, rx: &mut Rx) {
                 if let Some(desc) = crate::dxf_ext::xdata(&tg, crate::dxf_ext::LAYER_DESCRIPTION_APP).iter().filter(|x| x.code == 1000).nth(1) {
                     l.description = desc.str();
                 }
-                match d.layer_mut(&name) {
-                    Some(x) => *x = l,
-                    None => d.layers.push(l),
+                match layer_index.get(&name.to_ascii_lowercase()) {
+                    Some(&i) => {
+                        if let Some(x) = d.layers.get_mut(i) {
+                            *x = l;
+                        }
+                    }
+                    None => {
+                        layer_index.insert(name.to_ascii_lowercase(), d.layers.len());
+                        d.layers.push(l);
+                    }
                 }
             }
             "LTYPE" => {
                 let name = t.s(2).unwrap_or_default();
-                if name.is_empty() || d.linetype(&name).is_some() {
+                if name.is_empty() || d.linetype(&name).is_some() || d.linetypes.len() >= MAX_OBJECTS {
                     continue;
                 }
                 let pattern = ltype_pattern(&tg, &ltype_styles);
@@ -1470,7 +1499,7 @@ fn tables(tags: &[Tag], d: &mut Drawing, rx: &mut Rx) {
             }
             "STYLE" => {
                 let name = t.s(2).unwrap_or_default();
-                if name.is_empty() {
+                if name.is_empty() || d.text_styles.len() >= MAX_OBJECTS {
                     continue;
                 }
                 // 70 bit 4: vertical; 71 bits 2/4: backwards / upside down.
@@ -1552,7 +1581,7 @@ fn tables(tags: &[Tag], d: &mut Drawing, rx: &mut Rx) {
             }
             "DIMSTYLE" => {
                 let name = t.s(2).unwrap_or_default();
-                if name.is_empty() {
+                if name.is_empty() || d.dim_styles.len() >= MAX_OBJECTS {
                     continue;
                 }
                 // Every variable with a DIMSTYLE group code; values the style can't take are
@@ -1651,6 +1680,11 @@ fn ltype_pattern(tags: &[Tag], styles: &HashMap<String, String>) -> Vec<DashElem
 
 /// Read a DXF file into a drawing.
 pub fn read(bytes: &[u8]) -> Result<Drawing> {
+    read_budgeted(bytes, 4_000_000)
+}
+
+/// Import DXF sections while sharing one materialized-table-cell budget across blocks and entity sections.
+fn read_budgeted(bytes: &[u8], mut table_cells_left: usize) -> Result<Drawing> {
     let tags = cadcraft_dxf::parse(bytes).map_err(|e| IoError::Format(e.to_string()))?;
     let secs = sections(&tags);
     if secs.is_empty() {
@@ -1705,7 +1739,7 @@ pub fn read(bytes: &[u8]) -> Result<Drawing> {
                             j += 1;
                         }
                         let body = recs.get(i + 1..j).unwrap_or(&[]);
-                        let ents = parse_entities(body, &mut d, &mut rx, &mut n);
+                        let ents = parse_entities(body, &mut d, &mut rx, &mut n, &mut table_cells_left);
                         blocks.push((name, base, description, ents, xref));
                         i = j + 1;
                     } else {
@@ -1721,7 +1755,7 @@ pub fn read(bytes: &[u8]) -> Result<Drawing> {
             // A damaged file may split its entities over several ENTITIES sections (#865).
             "ENTITIES" => {
                 let mut n = 0;
-                entities.extend(parse_entities(&records(&s.tags), &mut d, &mut rx, &mut n));
+                entities.extend(parse_entities(&records(&s.tags), &mut d, &mut rx, &mut n, &mut table_cells_left));
                 count_skipped(&mut skipped, "ENTITIES", n);
             }
             "OBJECTS" => {
@@ -2248,6 +2282,7 @@ fn page_setup(t: &T) -> PageSetup {
         _ => "layout",
     }
     .into();
+    p.plot_window = [t.fd(48, 0.0), t.fd(49, 0.0), t.fd(140, 0.0), t.fd(141, 0.0)].map(|v| if v.is_finite() { v } else { 0.0 });
     p.plot_style_table = t.s(7).unwrap_or_default();
     p
 }
@@ -2309,3 +2344,39 @@ fn helix(tags: &[Tag]) -> Helix {
 pub fn entity_from_groups(kind: &str, tags: &[Tag]) -> Option<(Common, EntityKind)> {
     entity(&kind.to_ascii_uppercase(), tags)
 }
+
+#[cfg(test)]
+mod table_budget_tests {
+    use super::*;
+    /// Build synthetic table tags with a requested row and column count for allocation-budget checks.
+    fn table_tags(rows: i64, cols: i64) -> Vec<Tag> {
+        vec![Tag::s(100, "AcDbTable"), Tag::i(91, rows), Tag::i(92, cols), Tag::i(171, 1), Tag::s(1, "cell")]
+    }
+    /// A table that cannot fit allocates no cell grid, while a smaller table spends only its cell count.
+    #[test]
+    fn exhausted_budget_rejects_before_materializing_cells() {
+        let mut left = 3;
+        let table = acad_table(&table_tags(2, 2), &mut left);
+        assert!(table.cells.is_empty() && table.row_heights.is_empty() && table.col_widths.is_empty());
+        assert_eq!(left, 3);
+        let table = acad_table(&table_tags(1, 2), &mut left);
+        assert_eq!(table.cells[0].len(), 2);
+        assert_eq!(left, 1);
+    }
+    /// Tables in blocks and repeated entity sections consume one document-wide cell allowance.
+    #[test]
+    fn blocks_and_entity_sections_share_one_budget() {
+        let table = "0\nACAD_TABLE\n100\nAcDbTable\n91\n1\n92\n2\n171\n1\n1\ncell\n";
+        let dxf = format!(
+            "0\nSECTION\n2\nBLOCKS\n0\nBLOCK\n2\nTEST\n10\n0\n20\n0\n{table}0\nENDBLK\n0\nENDSEC\n0\nSECTION\n2\nENTITIES\n{table}0\nENDSEC\n0\nSECTION\n2\nENTITIES\n{table}0\nENDSEC\n0\nEOF\n"
+        );
+        let d = read_budgeted(dxf.as_bytes(), 2).unwrap();
+        let block = d.block("TEST").unwrap();
+        let count = |e: &Entity| match &e.kind {
+            EntityKind::Table(t) => t.cells.iter().map(Vec::len).sum::<usize>(),
+            _ => 0,
+        };
+        assert_eq!(block.entities.iter().map(|e| count(e)).sum::<usize>(), 2);
+        assert_eq!(d.model.iter().map(|e| count(e)).sum::<usize>(), 0);
+    }
+}
diff --git a/crates/io/src/dxf_write.rs b/crates/io/src/dxf_write.rs
index ec4b8595f..24466ee10 100644
--- a/crates/io/src/dxf_write.rs
+++ b/crates/io/src/dxf_write.rs
@@ -1441,8 +1441,11 @@ fn table_size(t: &Table) -> (usize, usize) {
 
 /// The anonymous `*T` block of a table: cell fills, borders and texts as its cell styles draw
 /// them, for readers that only draw the block.
-fn table_block_entities(d: &Drawing, t: &Table, layer: &str) -> Vec<Entity> {
-    let g = cadcraft_render::table_geometry(d, t);
+///
+/// The block is relative to its own origin: the ACAD_TABLE reference adds the insertion point.
+pub(crate) fn table_block_entities(d: &Drawing, t: &Table, layer: &str) -> Vec<Entity> {
+    let at_origin = Table { insert: Vec3::ZERO, ..t.clone() };
+    let g = cadcraft_render::table_geometry(d, &at_origin);
     let c = Common { layer: layer.into(), color: Color::ByBlock, ..Common::default() };
     let mut out = Vec::new();
     for f in &g.fills {
@@ -2565,10 +2568,10 @@ fn tags_for(d: &Drawing, version: Version, target: Version) -> Vec<Tag> {
             (45, page.height_mm),
             (46, 0.0),
             (47, 0.0),
-            (48, 0.0),
-            (49, 0.0),
-            (140, 0.0),
-            (141, 0.0),
+            (48, page.plot_window[0]),
+            (49, page.plot_window[1]),
+            (140, page.plot_window[2]),
+            (141, page.plot_window[3]),
             (142, scale),
             (143, 1.0),
         ] {
diff --git a/crates/io/src/pdf.rs b/crates/io/src/pdf.rs
index 2a2295089..fd2742c17 100644
--- a/crates/io/src/pdf.rs
+++ b/crates/io/src/pdf.rs
@@ -511,9 +511,12 @@ fn links(list: &cadcraft_render::DisplayList, map: &Map, clip_pt: &Bounds2, link
     if links.is_empty() {
         return Vec::new();
     }
+    // Membership by handle, built once, so scanning primitives is O(primitives) rather than
+    // O(primitives × links): otherwise the two counts multiply into excessive work (CWE-407).
+    let linked: std::collections::HashSet<Handle> = links.iter().map(|(h, _)| *h).collect();
     let mut areas: std::collections::HashMap<Handle, Bounds2> = std::collections::HashMap::new();
     for p in &list.prims {
-        if matches!(p.kind, Kind::Infinite { .. }) || !links.iter().any(|(h, _)| *h == p.handle) {
+        if matches!(p.kind, Kind::Infinite { .. }) || !linked.contains(&p.handle) {
             continue;
         }
         let b = areas.entry(p.handle).or_insert(Bounds2::EMPTY);
diff --git a/crates/io/src/svg_read.rs b/crates/io/src/svg_read.rs
index f5abc84d6..4b2892c3d 100644
--- a/crates/io/src/svg_read.rs
+++ b/crates/io/src/svg_read.rs
@@ -38,6 +38,9 @@ const MAX_LAYERS: usize = 256;
 const MAX_TRANSFORM_DEPTH: usize = 64;
 /// Flattened chords per elliptical arc under a non-uniform transform.
 const MAX_ARC_CHORDS: usize = 10_000;
+/// Generated vertices retained across the whole document (all paths and shapes), so repeated
+/// arc/curve flattening cannot amplify a compact input into unbounded geometry.
+const MAX_TOTAL_VERTS: usize = 8_000_000;
 
 /// Elements whose whole subtree is skipped (paint servers, text, raster images, metadata).
 const SKIP: &[&[u8]] = &[
@@ -126,6 +129,10 @@ struct Parser {
     layers: HashSet<String>,
     layer_color: u8,
     elements: usize,
+    /// Generated vertices still allowed across the whole document. Arc/curve flattening can turn
+    /// a compact path into many samples, and each flushed run is retained, so without a shared
+    /// budget repeated arcs amplify a small input into gigabytes of geometry (CWE-400).
+    verts_left: usize,
     /// > 0 while inside a skipped subtree; counts the starts seen there.
     skip: usize,
     /// What was left out, by kind ([`LeftOut`]).
@@ -165,6 +172,7 @@ impl LeftOut {
 }
 
 impl Parser {
+    /// Initialize a metric SVG drawing with one document-wide generated-vertex allowance.
     fn new() -> Self {
         Parser {
             drawing: Drawing::new_metric(),
@@ -173,6 +181,7 @@ impl Parser {
             layers: HashSet::from(["0".to_string()]),
             layer_color: 1,
             elements: 0,
+            verts_left: MAX_TOTAL_VERTS,
             skip: 0,
             left_out: BTreeMap::new(),
         }
@@ -198,15 +207,15 @@ impl Parser {
             match reader.read_event().map_err(parse_err)? {
                 Event::Start(e) => {
                     let name = e.name();
-                    self.on_start(name.as_ref(), &e)?;
+                    self.on_start(name.into_inner().as_bytes(), &e)?;
                 }
                 Event::Empty(e) => {
                     let name = e.name();
-                    self.on_element(name.as_ref(), &e)?;
+                    self.on_element(name.into_inner().as_bytes(), &e)?;
                 }
                 Event::End(e) => {
                     let name = e.name();
-                    self.on_end(name.as_ref());
+                    self.on_end(name.into_inner().as_bytes());
                 }
                 Event::Eof => break,
                 _ => {}
@@ -326,11 +335,20 @@ impl Parser {
         self.cur().apply_vec(v)
     }
 
+    /// Charge an entity against element and retained-vertex limits before adding it to model space.
     fn add(&mut self, kind: EntityKind) -> Result<()> {
         self.elements += 1;
         if self.elements > MAX_ELEMENTS {
             return Err(IoError::Format(format!("SVG: more than {MAX_ELEMENTS} elements")));
         }
+        // Charge the vertices this entity retains against the shared document budget, so repeated
+        // flattened arcs/curves cannot amplify a compact path into unbounded geometry (CWE-400).
+        let verts = match &kind {
+            EntityKind::LwPolyline(p) => p.vertices.len(),
+            EntityKind::Spline(s) => s.control.len(),
+            _ => 1,
+        };
+        self.verts_left = self.verts_left.checked_sub(verts).ok_or_else(|| IoError::Format("SVG: too much generated geometry".into()))?;
         let common = Common { layer: self.layer.clone(), ..Common::default() };
         self.drawing.add(&Space::Model, common, kind).map(|_| ()).map_err(parse_err)
     }
@@ -560,7 +578,7 @@ fn hidden(e: &BytesStart) -> bool {
 
 fn attr(e: &BytesStart, name: &[u8]) -> Option<String> {
     for a in e.attributes().flatten() {
-        if a.key.as_ref() == name {
+        if a.key.into_inner().as_bytes() == name {
             return a.normalized_value(XmlVersion::Explicit1_0).ok().map(|v| v.into_owned());
         }
     }
diff --git a/crates/io/src/tests.rs b/crates/io/src/tests.rs
index 8b7f56474..2c741b803 100644
--- a/crates/io/src/tests.rs
+++ b/crates/io/src/tests.rs
@@ -1343,6 +1343,23 @@ fn tables_roundtrip_with_title_header_and_merges() {
     assert_eq!(again.blocks.len(), back.blocks.len());
 }
 
+#[test]
+fn table_block_is_relative_to_the_insertion_point() {
+    let d = Drawing::new_imperial();
+    let t = table_sample();
+    let ents = crate::dxf_write::table_block_entities(&d, &t, "0");
+    let mut xs = Vec::new();
+    for e in &ents {
+        if let EntityKind::Line(l) = &e.kind {
+            xs.extend([l.a.x, l.b.x]);
+        }
+    }
+    assert!(!xs.is_empty());
+    let (min, max) = xs.iter().fold((f64::MAX, f64::MIN), |(lo, hi), &x| (lo.min(x), hi.max(x)));
+    // Columns total 8 wide; the block starts at its own origin, not at the insert x of 5.
+    assert!(min.abs() < 1e-9 && (max - 8.0).abs() < 1e-9, "block x range {min}..{max}");
+}
+
 #[test]
 fn text_style_flags_roundtrip() {
     let mut d = Drawing::new_imperial();
diff --git a/crates/io/tests/acad_interop.rs b/crates/io/tests/it/acad_interop.rs
similarity index 100%
rename from crates/io/tests/acad_interop.rs
rename to crates/io/tests/it/acad_interop.rs
diff --git a/crates/io/tests/acis_data_store.rs b/crates/io/tests/it/acis_data_store.rs
similarity index 99%
rename from crates/io/tests/acis_data_store.rs
rename to crates/io/tests/it/acis_data_store.rs
index 137b31f2a..74b9809ce 100644
--- a/crates/io/tests/acis_data_store.rs
+++ b/crates/io/tests/it/acis_data_store.rs
@@ -2,7 +2,6 @@
 //! don't carry it themselves: it lives in the file's data store section (ACDSDATA), one record per
 //! entity bound by a 320 handle. CADCraft doesn't model solids, so it keeps the section as read and
 //! writes it back (and the DWG bridge reads it), without the records of deleted entities.
-#![cfg(not(target_arch = "wasm32"))]
 
 use cadcraft_doc::EntityKind;
 
diff --git a/crates/io/tests/angle_header.rs b/crates/io/tests/it/angle_header.rs
similarity index 100%
rename from crates/io/tests/angle_header.rs
rename to crates/io/tests/it/angle_header.rs
diff --git a/crates/io/tests/annotative_roundtrip.rs b/crates/io/tests/it/annotative_roundtrip.rs
similarity index 100%
rename from crates/io/tests/annotative_roundtrip.rs
rename to crates/io/tests/it/annotative_roundtrip.rs
diff --git a/crates/io/tests/assoc_array_roundtrip.rs b/crates/io/tests/it/assoc_array_roundtrip.rs
similarity index 100%
rename from crates/io/tests/assoc_array_roundtrip.rs
rename to crates/io/tests/it/assoc_array_roundtrip.rs
diff --git a/crates/io/tests/attrib_modes.rs b/crates/io/tests/it/attrib_modes.rs
similarity index 100%
rename from crates/io/tests/attrib_modes.rs
rename to crates/io/tests/it/attrib_modes.rs
diff --git a/crates/io/tests/attrib_props.rs b/crates/io/tests/it/attrib_props.rs
similarity index 100%
rename from crates/io/tests/attrib_props.rs
rename to crates/io/tests/it/attrib_props.rs
diff --git a/crates/io/tests/block_expansion.rs b/crates/io/tests/it/block_expansion.rs
similarity index 100%
rename from crates/io/tests/block_expansion.rs
rename to crates/io/tests/it/block_expansion.rs
diff --git a/crates/io/tests/closed_spline.rs b/crates/io/tests/it/closed_spline.rs
similarity index 100%
rename from crates/io/tests/closed_spline.rs
rename to crates/io/tests/it/closed_spline.rs
diff --git a/crates/io/tests/codepages.rs b/crates/io/tests/it/codepages.rs
similarity index 100%
rename from crates/io/tests/codepages.rs
rename to crates/io/tests/it/codepages.rs
diff --git a/crates/io/tests/dim_block_resave_roundtrip.rs b/crates/io/tests/it/dim_block_resave_roundtrip.rs
similarity index 100%
rename from crates/io/tests/dim_block_resave_roundtrip.rs
rename to crates/io/tests/it/dim_block_resave_roundtrip.rs
diff --git a/crates/io/tests/dim_block_text.rs b/crates/io/tests/it/dim_block_text.rs
similarity index 100%
rename from crates/io/tests/dim_block_text.rs
rename to crates/io/tests/it/dim_block_text.rs
diff --git a/crates/io/tests/dim_marks_roundtrip.rs b/crates/io/tests/it/dim_marks_roundtrip.rs
similarity index 100%
rename from crates/io/tests/dim_marks_roundtrip.rs
rename to crates/io/tests/it/dim_marks_roundtrip.rs
diff --git a/crates/io/tests/dimstyle_vars_roundtrip.rs b/crates/io/tests/it/dimstyle_vars_roundtrip.rs
similarity index 100%
rename from crates/io/tests/dimstyle_vars_roundtrip.rs
rename to crates/io/tests/it/dimstyle_vars_roundtrip.rs
diff --git a/crates/io/tests/drafting_spacing.rs b/crates/io/tests/it/drafting_spacing.rs
similarity index 100%
rename from crates/io/tests/drafting_spacing.rs
rename to crates/io/tests/it/drafting_spacing.rs
diff --git a/crates/io/tests/dwg_header_vars.rs b/crates/io/tests/it/dwg_header_vars.rs
similarity index 98%
rename from crates/io/tests/dwg_header_vars.rs
rename to crates/io/tests/it/dwg_header_vars.rs
index 178a5d274..d1850278f 100644
--- a/crates/io/tests/dwg_header_vars.rs
+++ b/crates/io/tests/it/dwg_header_vars.rs
@@ -1,7 +1,6 @@
 //! Unit, angle and drafting settings in the drawing header survive saving as DXF or DWG and
 //! reopening. The DWG bridge converts with acadrust, whose DXF writer leaves some header
 //! variables out; the snap grid's origin and rotation live in the `*ACTIVE` VPORT record.
-#![cfg(not(target_arch = "wasm32"))]
 
 use cadcraft_doc::{Drawing, HVal};
 use cadcraft_geom::Vec3;
diff --git a/crates/io/tests/dwg_layout_owner.rs b/crates/io/tests/it/dwg_layout_owner.rs
similarity index 100%
rename from crates/io/tests/dwg_layout_owner.rs
rename to crates/io/tests/it/dwg_layout_owner.rs
diff --git a/crates/io/tests/dwg_roundtrip_losses.rs b/crates/io/tests/it/dwg_roundtrip_losses.rs
similarity index 99%
rename from crates/io/tests/dwg_roundtrip_losses.rs
rename to crates/io/tests/it/dwg_roundtrip_losses.rs
index 813ae6593..c0852eff1 100644
--- a/crates/io/tests/dwg_roundtrip_losses.rs
+++ b/crates/io/tests/it/dwg_roundtrip_losses.rs
@@ -1,6 +1,5 @@
 //! Data that used to be lost only when a drawing is saved as DWG and reopened (the DWG bridge
 //! converts our DXF with acadrust), and the paper-space viewport the DXF writer adds for it.
-#![cfg(not(target_arch = "wasm32"))]
 
 use cadcraft_color::{Color, Rgb};
 use cadcraft_doc::*;
diff --git a/crates/io/tests/dwt_template.rs b/crates/io/tests/it/dwt_template.rs
similarity index 100%
rename from crates/io/tests/dwt_template.rs
rename to crates/io/tests/it/dwt_template.rs
diff --git a/crates/io/tests/dxf_versions.rs b/crates/io/tests/it/dxf_versions.rs
similarity index 100%
rename from crates/io/tests/dxf_versions.rs
rename to crates/io/tests/it/dxf_versions.rs
diff --git a/crates/io/tests/dynblock_read.rs b/crates/io/tests/it/dynblock_read.rs
similarity index 95%
rename from crates/io/tests/dynblock_read.rs
rename to crates/io/tests/it/dynblock_read.rs
index 40914fe16..d265f9e70 100644
--- a/crates/io/tests/dynblock_read.rs
+++ b/crates/io/tests/it/dynblock_read.rs
@@ -22,7 +22,7 @@ fn dxf(src: &str) -> String {
 /// The DOOR drawing as `code value` lines (shared with the engine's dynamic grip tests), with
 /// LF line ends whatever a checkout gave the file.
 fn fixture() -> String {
-    include_str!("data/dynblock_door.txt").replace("\r\n", "\n")
+    include_str!("../data/dynblock_door.txt").replace("\r\n", "\n")
 }
 
 fn h(hex: &str) -> Handle {
@@ -536,3 +536,29 @@ fn dragging_a_distance_grip_changes_the_distance() {
     assert!(drag_grip(&mut d, h("30"), 2, GripPart::End, Vec2::new(130.0, 0.0)).is_err(), "not a reference");
     assert_eq!(d, before);
 }
+
+/// The DOOR drawing with every handle moved above 2^48: AutoCAD writes such handles (seen in
+/// drawings whose handles start at 0xDAD1…), and the dynamic block's objects must still be kept.
+fn far_handles(src: &str) -> String {
+    const SHIFT: u64 = 0x000D_AD10_0000_0000;
+    let is_handle = |code: i32| matches!(code, 5 | 105 | 320..=369 | 390..=399 | 480 | 481 | 1005);
+    let mut out = String::new();
+    for line in src.lines() {
+        let (code, value) = line.trim().split_once(' ').unwrap_or((line.trim(), ""));
+        let moved = match (code.parse::<i32>(), u64::from_str_radix(value, 16)) {
+            (Ok(c), Ok(h)) if is_handle(c) && h != 0 => format!("{:X}", h + SHIFT),
+            _ => value.to_string(),
+        };
+        out.push_str(&format!("{code} {moved}\n"));
+    }
+    out
+}
+
+#[test]
+fn a_dynamic_block_with_handles_above_2_pow_48_is_kept() {
+    let src = far_handles(&fixture());
+    let d = read_dxf(dxf(&src).as_bytes()).unwrap();
+    let before = dynamic_block(&d, "Door").expect("the dynamic block with far handles");
+    let again = read_dxf(write_dxf(&d).as_bytes()).unwrap();
+    assert_eq!(by_node(dynamic_block(&again, "Door").unwrap()), by_node(before));
+}
diff --git a/crates/io/tests/entity_props_roundtrip.rs b/crates/io/tests/it/entity_props_roundtrip.rs
similarity index 100%
rename from crates/io/tests/entity_props_roundtrip.rs
rename to crates/io/tests/it/entity_props_roundtrip.rs
diff --git a/crates/io/tests/followups_626.rs b/crates/io/tests/it/followups_626.rs
similarity index 100%
rename from crates/io/tests/followups_626.rs
rename to crates/io/tests/it/followups_626.rs
diff --git a/crates/io/tests/groups_roundtrip.rs b/crates/io/tests/it/groups_roundtrip.rs
similarity index 100%
rename from crates/io/tests/groups_roundtrip.rs
rename to crates/io/tests/it/groups_roundtrip.rs
diff --git a/crates/io/tests/hatch_assoc_roundtrip.rs b/crates/io/tests/it/hatch_assoc_roundtrip.rs
similarity index 100%
rename from crates/io/tests/hatch_assoc_roundtrip.rs
rename to crates/io/tests/it/hatch_assoc_roundtrip.rs
diff --git a/crates/io/tests/hatch_pattern_def.rs b/crates/io/tests/it/hatch_pattern_def.rs
similarity index 100%
rename from crates/io/tests/hatch_pattern_def.rs
rename to crates/io/tests/it/hatch_pattern_def.rs
diff --git a/crates/io/tests/helix_roundtrip.rs b/crates/io/tests/it/helix_roundtrip.rs
similarity index 100%
rename from crates/io/tests/helix_roundtrip.rs
rename to crates/io/tests/it/helix_roundtrip.rs
diff --git a/crates/io/tests/layout_paper_units.rs b/crates/io/tests/it/layout_paper_units.rs
similarity index 100%
rename from crates/io/tests/layout_paper_units.rs
rename to crates/io/tests/it/layout_paper_units.rs
diff --git a/crates/io/tests/it/layout_plot_window.rs b/crates/io/tests/it/layout_plot_window.rs
new file mode 100644
index 000000000..448fa83e5
--- /dev/null
+++ b/crates/io/tests/it/layout_plot_window.rs
@@ -0,0 +1,25 @@
+//! #1667: a layout whose page setup plots a window (DXF plot type 4) lost the window corners
+//! (groups 48, 49, 140, 141) on save: they were written as zero.
+
+use cadcraft_doc::{Drawing, Layout, PageSetup};
+use cadcraft_io::{read, write_dxf};
+
+#[test]
+fn plot_window_corners_round_trip_through_dxf() {
+    let mut d = Drawing::new_metric();
+    let mut l = Layout::new("WIN", 3);
+    l.page = PageSetup {
+        width_mm: 297.0,
+        height_mm: 420.0,
+        margins_mm: [0.0; 4],
+        plot_area: "window".into(),
+        plot_window: [0.0, -297.0, 420.0, 0.0],
+        ..PageSetup::default()
+    };
+    d.layouts.push(l);
+
+    let back = read(write_dxf(&d).as_bytes(), "win.dxf").unwrap();
+    let page = &back.layouts.iter().find(|l| l.name == "WIN").unwrap().page;
+    assert_eq!(page.plot_area, "window");
+    assert_eq!(page.plot_window, [0.0, -297.0, 420.0, 0.0]);
+}
diff --git a/crates/io/tests/low_handseed.rs b/crates/io/tests/it/low_handseed.rs
similarity index 98%
rename from crates/io/tests/low_handseed.rs
rename to crates/io/tests/it/low_handseed.rs
index 6b7a9e09c..fbc1a77b6 100644
--- a/crates/io/tests/low_handseed.rs
+++ b/crates/io/tests/it/low_handseed.rs
@@ -1,7 +1,6 @@
 //! Another program's file can name a $HANDSEED below handles it uses. Entities CADCraft makes
 //! while reading (the faces a polyface mesh becomes) must not take handles that records further
 //! on still have: a DWG keeps one object per handle, so the duplicates were lost on save.
-#![cfg(not(target_arch = "wasm32"))]
 
 use std::collections::HashSet;
 
diff --git a/crates/io/tests/it/main.rs b/crates/io/tests/it/main.rs
new file mode 100644
index 000000000..1b1462ae5
--- /dev/null
+++ b/crates/io/tests/it/main.rs
@@ -0,0 +1,67 @@
+mod acad_interop;
+#[cfg(not(target_arch = "wasm32"))]
+mod acis_data_store;
+mod angle_header;
+mod annotative_roundtrip;
+mod assoc_array_roundtrip;
+mod attrib_modes;
+mod attrib_props;
+mod block_expansion;
+mod closed_spline;
+mod codepages;
+mod dim_block_resave_roundtrip;
+mod dim_block_text;
+mod dim_marks_roundtrip;
+mod dimstyle_vars_roundtrip;
+mod drafting_spacing;
+#[cfg(not(target_arch = "wasm32"))]
+mod dwg_header_vars;
+mod dwg_layout_owner;
+#[cfg(not(target_arch = "wasm32"))]
+mod dwg_roundtrip_losses;
+mod dwt_template;
+mod dxf_versions;
+mod dynblock_read;
+mod entity_props_roundtrip;
+mod followups_626;
+mod groups_roundtrip;
+mod hatch_assoc_roundtrip;
+mod hatch_pattern_def;
+mod helix_roundtrip;
+mod layout_paper_units;
+mod layout_plot_window;
+#[cfg(not(target_arch = "wasm32"))]
+mod low_handseed;
+mod mleader_content;
+mod mleader_roundtrip;
+mod mline_roundtrip;
+#[cfg(not(target_arch = "wasm32"))]
+mod model_layout_plot_type;
+mod mtext_columns_roundtrip;
+mod mtext_embedded_object;
+mod mtext_line_spacing;
+mod multiline_attributes;
+mod paperview_marker;
+mod passthrough_image_roundtrip;
+mod pdf_followups;
+mod pdf_layers;
+mod plot_layout_scale;
+mod plot_model_png_scale;
+mod plot_styles;
+mod region_roundtrip;
+mod roundtrip_audit;
+mod skipped_records;
+mod sortents;
+mod spline_fit_data;
+mod split_entities_section;
+mod style_typeface;
+mod svg_arc_budget;
+mod svg_tiny_extents;
+mod table_cellstyle_roundtrip;
+mod tables_objects_roundtrip;
+mod text_left_justify;
+mod tolerance_roundtrip;
+mod user_lin_pat_roundtrip;
+mod view_tables_roundtrip;
+mod viewport_clip_roundtrip;
+mod xref_roundtrip;
diff --git a/crates/io/tests/mleader_content.rs b/crates/io/tests/it/mleader_content.rs
similarity index 100%
rename from crates/io/tests/mleader_content.rs
rename to crates/io/tests/it/mleader_content.rs
diff --git a/crates/io/tests/mleader_roundtrip.rs b/crates/io/tests/it/mleader_roundtrip.rs
similarity index 100%
rename from crates/io/tests/mleader_roundtrip.rs
rename to crates/io/tests/it/mleader_roundtrip.rs
diff --git a/crates/io/tests/mline_roundtrip.rs b/crates/io/tests/it/mline_roundtrip.rs
similarity index 100%
rename from crates/io/tests/mline_roundtrip.rs
rename to crates/io/tests/it/mline_roundtrip.rs
diff --git a/crates/io/tests/model_layout_plot_type.rs b/crates/io/tests/it/model_layout_plot_type.rs
similarity index 98%
rename from crates/io/tests/model_layout_plot_type.rs
rename to crates/io/tests/it/model_layout_plot_type.rs
index 3de6380e5..55c6d62a8 100644
--- a/crates/io/tests/model_layout_plot_type.rs
+++ b/crates/io/tests/it/model_layout_plot_type.rs
@@ -2,7 +2,6 @@
 //! fitted to the paper. Plot type 5 ("Layout information", DXF Reference, PLOTSETTINGS group 74)
 //! means nothing for model space; another program's Plot dialog then showed no plot area and no
 //! scale for Model.
-#![cfg(not(target_arch = "wasm32"))]
 
 use cadcraft_doc::*;
 use cadcraft_geom::Vec3;
diff --git a/crates/io/tests/mtext_columns_roundtrip.rs b/crates/io/tests/it/mtext_columns_roundtrip.rs
similarity index 100%
rename from crates/io/tests/mtext_columns_roundtrip.rs
rename to crates/io/tests/it/mtext_columns_roundtrip.rs
diff --git a/crates/io/tests/mtext_embedded_object.rs b/crates/io/tests/it/mtext_embedded_object.rs
similarity index 100%
rename from crates/io/tests/mtext_embedded_object.rs
rename to crates/io/tests/it/mtext_embedded_object.rs
diff --git a/crates/io/tests/mtext_line_spacing.rs b/crates/io/tests/it/mtext_line_spacing.rs
similarity index 100%
rename from crates/io/tests/mtext_line_spacing.rs
rename to crates/io/tests/it/mtext_line_spacing.rs
diff --git a/crates/io/tests/multiline_attributes.rs b/crates/io/tests/it/multiline_attributes.rs
similarity index 100%
rename from crates/io/tests/multiline_attributes.rs
rename to crates/io/tests/it/multiline_attributes.rs
diff --git a/crates/io/tests/paperview_marker.rs b/crates/io/tests/it/paperview_marker.rs
similarity index 100%
rename from crates/io/tests/paperview_marker.rs
rename to crates/io/tests/it/paperview_marker.rs
diff --git a/crates/io/tests/passthrough_image_roundtrip.rs b/crates/io/tests/it/passthrough_image_roundtrip.rs
similarity index 100%
rename from crates/io/tests/passthrough_image_roundtrip.rs
rename to crates/io/tests/it/passthrough_image_roundtrip.rs
diff --git a/crates/io/tests/pdf_followups.rs b/crates/io/tests/it/pdf_followups.rs
similarity index 100%
rename from crates/io/tests/pdf_followups.rs
rename to crates/io/tests/it/pdf_followups.rs
diff --git a/crates/io/tests/pdf_layers.rs b/crates/io/tests/it/pdf_layers.rs
similarity index 100%
rename from crates/io/tests/pdf_layers.rs
rename to crates/io/tests/it/pdf_layers.rs
diff --git a/crates/io/tests/plot_layout_scale.rs b/crates/io/tests/it/plot_layout_scale.rs
similarity index 100%
rename from crates/io/tests/plot_layout_scale.rs
rename to crates/io/tests/it/plot_layout_scale.rs
diff --git a/crates/io/tests/plot_model_png_scale.rs b/crates/io/tests/it/plot_model_png_scale.rs
similarity index 100%
rename from crates/io/tests/plot_model_png_scale.rs
rename to crates/io/tests/it/plot_model_png_scale.rs
diff --git a/crates/io/tests/plot_styles.rs b/crates/io/tests/it/plot_styles.rs
similarity index 100%
rename from crates/io/tests/plot_styles.rs
rename to crates/io/tests/it/plot_styles.rs
diff --git a/crates/io/tests/region_roundtrip.rs b/crates/io/tests/it/region_roundtrip.rs
similarity index 100%
rename from crates/io/tests/region_roundtrip.rs
rename to crates/io/tests/it/region_roundtrip.rs
diff --git a/crates/io/tests/roundtrip_audit.rs b/crates/io/tests/it/roundtrip_audit.rs
similarity index 100%
rename from crates/io/tests/roundtrip_audit.rs
rename to crates/io/tests/it/roundtrip_audit.rs
diff --git a/crates/io/tests/skipped_records.rs b/crates/io/tests/it/skipped_records.rs
similarity index 100%
rename from crates/io/tests/skipped_records.rs
rename to crates/io/tests/it/skipped_records.rs
diff --git a/crates/io/tests/sortents.rs b/crates/io/tests/it/sortents.rs
similarity index 100%
rename from crates/io/tests/sortents.rs
rename to crates/io/tests/it/sortents.rs
diff --git a/crates/io/tests/spline_fit_data.rs b/crates/io/tests/it/spline_fit_data.rs
similarity index 100%
rename from crates/io/tests/spline_fit_data.rs
rename to crates/io/tests/it/spline_fit_data.rs
diff --git a/crates/io/tests/split_entities_section.rs b/crates/io/tests/it/split_entities_section.rs
similarity index 100%
rename from crates/io/tests/split_entities_section.rs
rename to crates/io/tests/it/split_entities_section.rs
diff --git a/crates/io/tests/style_typeface.rs b/crates/io/tests/it/style_typeface.rs
similarity index 100%
rename from crates/io/tests/style_typeface.rs
rename to crates/io/tests/it/style_typeface.rs
diff --git a/crates/io/tests/it/svg_arc_budget.rs b/crates/io/tests/it/svg_arc_budget.rs
new file mode 100644
index 000000000..dbcc97150
--- /dev/null
+++ b/crates/io/tests/it/svg_arc_budget.rs
@@ -0,0 +1,34 @@
+//! Reading an SVG whose paths flatten into a huge number of retained vertices must be rejected by
+//! the document-wide generated-geometry budget, not amplified into gigabytes (CWE-400, row 31).
+
+use cadcraft_io::read;
+
+/// A path with many elliptical-arc subpaths under a non-uniform group transform; each subpath
+/// flushes to its own retained polyline, so enough of them must exceed the document vertex budget.
+fn arc_bomb(arcs: usize) -> Vec<u8> {
+    // `scale(1 2)` makes the transform non-uniform, forcing per-sample flattening rather than a
+    // single bulge arc. Each `M … a …` is a separate subpath that is flushed and retained.
+    let mut d = String::new();
+    for i in 0..arcs {
+        let y = i as i32;
+        d.push_str(&format!("M 0 {y} a 1000 500 0 1 1 1 1 "));
+    }
+    let svg = format!(r#"<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 100 100"><g transform="scale(1 2)"><path d="{d}"/></g></svg>"#);
+    svg.into_bytes()
+}
+
+/// A small transformed-arc input remains accepted within the generated-geometry budget.
+#[test]
+fn a_modest_arc_svg_still_reads() {
+    // A handful of arcs is well within budget and parses fine.
+    let d = read(&arc_bomb(4), "a.svg").expect("a small arc SVG should read");
+    assert!(d.model.iter().count() >= 1, "expected some geometry");
+}
+
+/// Repeated flattened arcs fail with a geometry-budget error before retaining excessive vertices.
+#[test]
+fn an_arc_heavy_svg_is_rejected_by_the_vertex_budget() {
+    // ~1000 arcs x up to 10_000 chords each would far exceed the 8M vertex budget.
+    let err = read(&arc_bomb(30000), "a.svg");
+    assert!(err.unwrap_err().to_string().contains("SVG: too much generated geometry"));
+}
diff --git a/crates/io/tests/svg_tiny_extents.rs b/crates/io/tests/it/svg_tiny_extents.rs
similarity index 100%
rename from crates/io/tests/svg_tiny_extents.rs
rename to crates/io/tests/it/svg_tiny_extents.rs
diff --git a/crates/io/tests/table_cellstyle_roundtrip.rs b/crates/io/tests/it/table_cellstyle_roundtrip.rs
similarity index 100%
rename from crates/io/tests/table_cellstyle_roundtrip.rs
rename to crates/io/tests/it/table_cellstyle_roundtrip.rs
diff --git a/crates/io/tests/tables_objects_roundtrip.rs b/crates/io/tests/it/tables_objects_roundtrip.rs
similarity index 100%
rename from crates/io/tests/tables_objects_roundtrip.rs
rename to crates/io/tests/it/tables_objects_roundtrip.rs
diff --git a/crates/io/tests/text_left_justify.rs b/crates/io/tests/it/text_left_justify.rs
similarity index 100%
rename from crates/io/tests/text_left_justify.rs
rename to crates/io/tests/it/text_left_justify.rs
diff --git a/crates/io/tests/tolerance_roundtrip.rs b/crates/io/tests/it/tolerance_roundtrip.rs
similarity index 100%
rename from crates/io/tests/tolerance_roundtrip.rs
rename to crates/io/tests/it/tolerance_roundtrip.rs
diff --git a/crates/io/tests/user_lin_pat_roundtrip.rs b/crates/io/tests/it/user_lin_pat_roundtrip.rs
similarity index 100%
rename from crates/io/tests/user_lin_pat_roundtrip.rs
rename to crates/io/tests/it/user_lin_pat_roundtrip.rs
diff --git a/crates/io/tests/view_tables_roundtrip.rs b/crates/io/tests/it/view_tables_roundtrip.rs
similarity index 100%
rename from crates/io/tests/view_tables_roundtrip.rs
rename to crates/io/tests/it/view_tables_roundtrip.rs
diff --git a/crates/io/tests/viewport_clip_roundtrip.rs b/crates/io/tests/it/viewport_clip_roundtrip.rs
similarity index 100%
rename from crates/io/tests/viewport_clip_roundtrip.rs
rename to crates/io/tests/it/viewport_clip_roundtrip.rs
diff --git a/crates/io/tests/xref_roundtrip.rs b/crates/io/tests/it/xref_roundtrip.rs
similarity index 100%
rename from crates/io/tests/xref_roundtrip.rs
rename to crates/io/tests/it/xref_roundtrip.rs
diff --git a/crates/mcp/Cargo.toml b/crates/mcp/Cargo.toml
index 9bfc18e2c..955a6b6d2 100644
--- a/crates/mcp/Cargo.toml
+++ b/crates/mcp/Cargo.toml
@@ -14,3 +14,5 @@ cadcraft-render = { workspace = true }
 cadcraft-io = { workspace = true }
 serde_json = { workspace = true }
 log = { workspace = true }
+# Secure randomness for the per-session control token (MIT OR Apache-2.0).
+getrandom = "0.4"
diff --git a/crates/mcp/src/backend.rs b/crates/mcp/src/backend.rs
index cbde5c7b8..693839335 100644
--- a/crates/mcp/src/backend.rs
+++ b/crates/mcp/src/backend.rs
@@ -10,9 +10,11 @@ use serde_json::{Value, json};
 /// Something that answers control-channel methods (`engine.execute`, `cmdline.input`,
 /// `drawing.inspect`, `ui.render`…). See `cadcraft_ui_egui::control` for the full list.
 pub trait Backend {
+    /// Invoke a control method and return its result or a descriptive error.
     fn call(&mut self, method: &str, params: Value) -> Result<Value, String>;
     /// True when a real UI is attached (`ui.screenshot` works).
     fn has_ui(&self) -> bool;
+    /// Describe the backend connection for client-facing status.
     fn describe(&self) -> String;
 }
 
@@ -23,14 +25,23 @@ pub struct Remote {
     next_id: u64,
     /// Open the app when nothing answers (see [`Remote::lazy`]).
     launch: bool,
+    /// The per-session control token for this port, read from the owner-only token file on first
+    /// use so requests can authenticate (CWE-306).
+    token: Option<String>,
+}
+
+/// The port component of a `HOST:PORT` address, for locating the token file.
+fn port_of(addr: &str) -> Option<u16> {
+    addr.rsplit(':').next().and_then(|p| p.parse::<u16>().ok())
 }
 
 /// How long a launched app has to open its control port.
 const LAUNCH_WAIT: Duration = Duration::from_secs(30);
 
 impl Remote {
+    /// Connect to a running control server; its session token is read lazily when the first request is sent.
     pub fn connect(addr: &str) -> std::io::Result<Self> {
-        let mut r = Self { addr: addr.to_string(), conn: None, next_id: 1, launch: false };
+        let mut r = Self { addr: addr.to_string(), conn: None, next_id: 1, launch: false, token: None };
         r.reconnect()?;
         Ok(r)
     }
@@ -38,7 +49,20 @@ impl Remote {
     /// the server before the app is open. With `launch`, a call that finds nothing at `addr`
     /// opens the app with that control port first (macOS) and waits for it.
     pub fn lazy(addr: &str, launch: bool) -> Self {
-        Self { addr: addr.to_string(), conn: None, next_id: 1, launch }
+        Self { addr: addr.to_string(), conn: None, next_id: 1, launch, token: None }
+    }
+
+    /// The per-session token for this port, read (and cached) from the owner-only token file. A
+    /// missing file is not fatal here: the request is sent without a token and the server replies
+    /// with an authentication error the user can act on.
+    fn token(&mut self) -> Option<&str> {
+        if self.token.is_none()
+            && let Some(port) = port_of(&self.addr)
+            && let Ok(t) = crate::control_token::read(port)
+        {
+            self.token = Some(t);
+        }
+        self.token.as_deref()
     }
     /// Connect, opening the app first when asked to and nothing answers.
     fn reach(&mut self) -> std::io::Result<()> {
@@ -91,7 +115,9 @@ impl Remote {
         let sent = writer.write_all(line.as_bytes()).and_then(|()| writer.write_all(b"\n")).and_then(|()| writer.flush());
         if let Err(e) = sent {
             self.conn = None;
-            return Err((e, false));
+            // write_all can fail after partial delivery. The server may have received the full
+            // JSON before the newline write failed, so a mutation must not be retried blindly.
+            return Err((e, true));
         }
         let mut reply = String::new();
         match reader.read_line(&mut reply) {
@@ -159,20 +185,40 @@ fn is_read_only(method: &str) -> bool {
 }
 
 impl Backend for Remote {
+    /// Send a control request with the token when available, refreshing it before a safe retry.
+    /// A mutation that may have reached the server is never resent automatically.
     fn call(&mut self, method: &str, params: Value) -> Result<Value, String> {
         let id = self.next_id;
         self.next_id += 1;
-        let line = json!({"id": id, "method": method, "params": params}).to_string();
-        let reply = match self.roundtrip(&line) {
+        let token = self.token().map(str::to_string);
+        let mut req = json!({"id": id, "method": method, "params": params});
+        if let (Some(obj), Some(token)) = (req.as_object_mut(), token) {
+            obj.insert("token".into(), Value::String(token));
+        }
+        let reply = match self.roundtrip(&req.to_string()) {
             Ok(r) => r,
-            // Resend only when the request cannot have been applied. After a sent mutation with no reply the outcome is unknown, and
-            // resending could apply it twice (for example two circles from one call), so report that instead.
-            Err((_, sent)) if !sent || is_read_only(method) => self.roundtrip(&line).map_err(|(e, _)| format!("CADCraft at {}: {e}", self.addr))?,
-            Err((e, _)) => {
-                return Err(format!(
-                    "CADCraft at {}: {e}; the reply was lost, so `{method}` may or may not have been applied. Inspect the drawing first",
-                    self.addr
-                ));
+            Err((e, sent)) => {
+                self.token = None;
+                self.conn = None;
+                // A mutation whose reply was lost must never be sent twice.
+                if sent && !is_read_only(method) {
+                    return Err(format!(
+                        "CADCraft at {}: {e}; the reply was lost, so `{method}` may or may not have been applied. Inspect the drawing first",
+                        self.addr
+                    ));
+                }
+                // A restarted server may have rotated its token before dropping the old socket.
+                if let Some(obj) = req.as_object_mut() {
+                    obj.remove("token");
+                    if let Some(token) = self.token() {
+                        obj.insert("token".into(), Value::String(token.to_owned()));
+                    }
+                }
+                self.roundtrip(&req.to_string()).map_err(|(e, _)| {
+                    self.token = None;
+                    self.conn = None;
+                    format!("CADCraft at {}: {e}", self.addr)
+                })?
             }
         };
         let v: Value = serde_json::from_str(&reply).map_err(|e| format!("bad reply: {e}"))?;
@@ -180,6 +226,10 @@ impl Backend for Remote {
             Ok(v.get("result").cloned().unwrap_or(Value::Null))
         } else {
             let e = v.get("error").and_then(Value::as_str).unwrap_or("error");
+            if e.starts_with("unauthorized") {
+                self.token = None;
+                self.conn = None;
+            }
             // A timeout says whether the request can still have run (#345).
             Err(match v.get("state").and_then(Value::as_str) {
                 Some("not-run") => format!("{e}: CADCraft did not start `{method}` and won't; it is safe to send again"),
@@ -375,9 +425,12 @@ mod tests {
             requests
         });
         let mut remote = Remote::connect(&addr).unwrap();
+        remote.token = Some("stale-token".into());
         let err = remote.call("engine.execute", json!({"command": "circle", "params": {}})).unwrap_err();
         assert!(err.contains("may or may not have been applied"), "{err}");
         assert_eq!(server.join().unwrap(), 1);
+        assert!(remote.token.is_none());
+        assert!(remote.conn.is_none());
     }
 
     /// The app's timeout reply says whether the request can still run; the error passes that on (#345).
@@ -399,4 +452,51 @@ mod tests {
             server.join().unwrap();
         }
     }
+    /// Retrying a read after a lost reply reloads the replacement server session token.
+    #[test]
+    fn safe_retry_rereads_a_rotated_token_after_a_lost_reply() {
+        let listener = TcpListener::bind("127.0.0.1:0").unwrap();
+        let addr = listener.local_addr().unwrap();
+        let old = crate::control_token::issue(addr.port()).unwrap();
+        let server = std::thread::spawn(move || {
+            let (conn, _) = listener.accept().unwrap();
+            let mut line = String::new();
+            let mut reader = BufReader::new(conn);
+            reader.read_line(&mut line).unwrap();
+            let first: Value = serde_json::from_str(&line).unwrap();
+            assert!(first["token"].as_str() == Some(old.as_str()));
+            let fresh = crate::control_token::issue(addr.port()).unwrap();
+            drop(reader);
+            let (mut conn, _) = listener.accept().unwrap();
+            line.clear();
+            BufReader::new(conn.try_clone().unwrap()).read_line(&mut line).unwrap();
+            let retry: Value = serde_json::from_str(&line).unwrap();
+            assert!(retry["token"].as_str() == Some(fresh.as_str()));
+            writeln!(conn, "{}", json!({"ok": true, "result": "pong"})).unwrap();
+            crate::control_token::revoke(addr.port());
+        });
+        let mut remote = Remote::connect(&addr.to_string()).unwrap();
+        assert_eq!(remote.call("ping", json!({})).unwrap(), json!("pong"));
+        server.join().unwrap();
+    }
+    /// A failed mutation write reports uncertain delivery and does not open a retry connection.
+    #[test]
+    fn failed_mutation_write_is_not_resent() {
+        let listener = TcpListener::bind("127.0.0.1:0").unwrap();
+        let addr = listener.local_addr().unwrap().to_string();
+        let mut remote = Remote::connect(&addr).unwrap();
+        remote.conn.as_ref().unwrap().1.shutdown(std::net::Shutdown::Write).unwrap();
+        let server = std::thread::spawn(move || {
+            let (conn, _) = listener.accept().unwrap();
+            let mut line = String::new();
+            assert_eq!(BufReader::new(conn).read_line(&mut line).unwrap(), 0);
+            listener.set_nonblocking(true).unwrap();
+            std::thread::sleep(Duration::from_millis(300));
+            listener.accept().is_ok()
+        });
+        let error = remote.call("engine.execute", json!({"command": "circle", "params": {}})).unwrap_err();
+        assert!(error.contains("may or may not have been applied"));
+        assert!(!server.join().unwrap(), "a failed mutation write was retried");
+        assert!(remote.token.is_none());
+    }
 }
diff --git a/crates/mcp/src/control_token.rs b/crates/mcp/src/control_token.rs
new file mode 100644
index 000000000..084f8b455
--- /dev/null
+++ b/crates/mcp/src/control_token.rs
@@ -0,0 +1,193 @@
+//! A per-session credential for the loopback control channel.
+//!
+//! The control server listens on `127.0.0.1`, but loopback TCP does not distinguish operating
+//! system users: any local account can connect and drive the desktop user's command and file
+//! authority (CWE-306). To authenticate the peer without changing the transport, the app issues an
+//! unguessable token at startup and writes it to a file only the desktop user can read. A client
+//! (the MCP bridge) reads the token from that file — which requires the same user's filesystem
+//! access — and sends it with every request. A different local user cannot read the token, so
+//! cannot authenticate.
+
+use std::io;
+use std::path::PathBuf;
+
+/// Length of the token in bytes (256 bits), rendered as lowercase hex.
+const TOKEN_BYTES: usize = 32;
+
+/// The file holding the control token for `port`, inside a per-user private directory.
+///
+/// On Unix the runtime dir (`XDG_RUNTIME_DIR`, already `0700` and per-user) is preferred, else the
+/// user's home; on Windows the local app-data directory. The file itself is created with
+/// owner-only permissions regardless.
+pub fn token_path(port: u16) -> io::Result<PathBuf> {
+    Ok(private_dir()?.join(format!("cadcraft-control-{port}.token")))
+}
+
+/// Choose the Unix runtime directory, home cache, or temporary directory for an owner-only token file.
+#[cfg(unix)]
+fn private_dir() -> io::Result<PathBuf> {
+    if let Some(d) = std::env::var_os("XDG_RUNTIME_DIR").filter(|v| !v.is_empty()) {
+        return Ok(PathBuf::from(d));
+    }
+    if let Some(h) = std::env::var_os("HOME").filter(|v| !v.is_empty()) {
+        return Ok(PathBuf::from(h).join(".cache"));
+    }
+    Ok(std::env::temp_dir())
+}
+
+/// Require the Windows per-user local app-data directory for session token storage.
+#[cfg(windows)]
+fn private_dir() -> io::Result<PathBuf> {
+    windows_private_dir(std::env::var_os("LOCALAPPDATA"))
+}
+
+/// Validate that Windows supplied a nonempty local app-data path instead of using a shared fallback.
+#[cfg(any(windows, test))]
+fn windows_private_dir(local: Option<std::ffi::OsString>) -> io::Result<PathBuf> {
+    local
+        .filter(|p| !p.is_empty())
+        .map(PathBuf::from)
+        .ok_or_else(|| io::Error::new(io::ErrorKind::NotFound, "LOCALAPPDATA is required for a private control token"))
+}
+
+/// Reject token storage on platforms without a supported private-directory convention.
+#[cfg(not(any(unix, windows)))]
+fn private_dir() -> io::Result<PathBuf> {
+    Err(io::Error::new(io::ErrorKind::Unsupported, "no private control token directory on this platform"))
+}
+
+/// Generate a fresh token and write it to [`token_path`] with owner-only permissions, returning
+/// the token. The file is replaced if it already exists.
+pub fn issue(port: u16) -> io::Result<String> {
+    let token = random_hex()?;
+    let path = token_path(port)?;
+    issue_at(&path, token.as_bytes())?;
+    Ok(token)
+}
+
+/// Create missing parent directories, then write the session token through the platform privacy helper.
+fn issue_at(path: &std::path::Path, bytes: &[u8]) -> io::Result<()> {
+    if let Some(parent) = path.parent() {
+        std::fs::create_dir_all(parent)?;
+    }
+    write_private(path, bytes)
+}
+
+/// Read the token for `port`, trimming trailing whitespace. Used by clients (the MCP bridge).
+pub fn read(port: u16) -> io::Result<String> {
+    let raw = std::fs::read_to_string(token_path(port)?)?;
+    let token = raw.trim().to_string();
+    if token.is_empty() {
+        return Err(io::Error::new(io::ErrorKind::InvalidData, "empty control token"));
+    }
+    Ok(token)
+}
+
+/// Remove the token file (best effort), called when the server stops.
+pub fn revoke(port: u16) {
+    if let Ok(path) = token_path(port) {
+        let _ = std::fs::remove_file(path);
+    }
+}
+
+/// Constant-time comparison of two tokens, so a wrong token cannot be guessed byte by byte.
+pub fn matches(expected: &str, given: &str) -> bool {
+    let (a, b) = (expected.as_bytes(), given.as_bytes());
+    if a.len() != b.len() {
+        return false;
+    }
+    let mut diff = 0u8;
+    for (x, y) in a.iter().zip(b.iter()) {
+        diff |= x ^ y;
+    }
+    diff == 0
+}
+
+/// Encode 256 bits of operating-system randomness as lowercase hexadecimal, propagating entropy failures.
+fn random_hex() -> io::Result<String> {
+    let mut bytes = [0u8; TOKEN_BYTES];
+    getrandom::fill(&mut bytes).map_err(|e| io::Error::other(format!("no secure randomness: {e}")))?;
+    let mut s = String::with_capacity(TOKEN_BYTES * 2);
+    for b in bytes {
+        use std::fmt::Write as _;
+        let _ = write!(s, "{b:02x}");
+    }
+    Ok(s)
+}
+
+/// Replace a stale token with an exclusively created file using Unix mode `0600`, then flush its bytes.
+#[cfg(unix)]
+fn write_private(path: &std::path::Path, bytes: &[u8]) -> io::Result<()> {
+    use std::io::Write;
+    use std::os::unix::fs::OpenOptionsExt;
+    // Replace any stale file, then create fresh with mode 0600 so no other user can read the token.
+    let _ = std::fs::remove_file(path);
+    let mut f = std::fs::OpenOptions::new().write(true).create_new(true).mode(0o600).open(path)?;
+    f.write_all(bytes)?;
+    f.flush()
+}
+
+/// Exclusively create and flush a replacement token within the per-user directory selected by the caller.
+#[cfg(not(unix))]
+fn write_private(path: &std::path::Path, bytes: &[u8]) -> io::Result<()> {
+    use std::io::Write;
+    // On Windows the per-user LOCALAPPDATA directory is already ACL-protected to the user.
+    let _ = std::fs::remove_file(path);
+    let mut f = std::fs::OpenOptions::new().write(true).create_new(true).open(path)?;
+    f.write_all(bytes)?;
+    f.flush()
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    /// An issued token has the expected size, can be read back, and disappears after revocation.
+    #[test]
+    fn issue_then_read_round_trips() {
+        let port = 50000 + (std::process::id() % 10000) as u16;
+        let token = issue(port).unwrap();
+        assert_eq!(token.len(), TOKEN_BYTES * 2);
+        assert_eq!(read(port).unwrap(), token);
+        revoke(port);
+        assert!(read(port).is_err());
+    }
+
+    /// Token comparison rejects different bytes and lengths while accepting identical tokens.
+    #[test]
+    fn matches_is_exact() {
+        assert!(matches("abc", "abc"));
+        assert!(!matches("abc", "abd"));
+        assert!(!matches("abc", "ab"));
+        assert!(!matches("", "x"));
+    }
+
+    /// A token issued on Unix grants no file permission bits to group or other users.
+    #[cfg(unix)]
+    #[test]
+    fn token_file_is_owner_only() {
+        use std::os::unix::fs::PermissionsExt;
+        let port = 40000 + (std::process::id() % 10000) as u16;
+        issue(port).unwrap();
+        let mode = std::fs::metadata(token_path(port).unwrap()).unwrap().permissions().mode();
+        assert_eq!(mode & 0o077, 0, "token file is readable by group/other: {:o}", mode);
+        revoke(port);
+    }
+    /// Windows token storage rejects absent or empty app-data paths and preserves a supplied path.
+    #[test]
+    fn windows_requires_local_app_data() {
+        assert!(windows_private_dir(None).is_err());
+        assert!(windows_private_dir(Some("".into())).is_err());
+        assert_eq!(windows_private_dir(Some("private-app-data".into())).unwrap(), PathBuf::from("private-app-data"));
+    }
+
+    /// Token issuance creates its missing directory hierarchy before writing the credential.
+    #[test]
+    fn issuance_creates_missing_parent() {
+        let dir = std::env::temp_dir().join(format!("cadcraft-token-parent-{}", std::process::id()));
+        let path = dir.join("missing/cache/session.token");
+        issue_at(&path, b"secret").unwrap();
+        assert_eq!(std::fs::read(&path).unwrap(), b"secret");
+        std::fs::remove_dir_all(dir).unwrap();
+    }
+}
diff --git a/crates/mcp/src/lib.rs b/crates/mcp/src/lib.rs
index 1d4d4162d..7fcf4849d 100644
--- a/crates/mcp/src/lib.rs
+++ b/crates/mcp/src/lib.rs
@@ -9,6 +9,7 @@
 #![forbid(unsafe_code)]
 
 mod backend;
+pub mod control_token;
 mod server;
 mod tools;
 
diff --git a/crates/mcp/tests/cmdline_key.rs b/crates/mcp/tests/it/cmdline_key.rs
similarity index 94%
rename from crates/mcp/tests/cmdline_key.rs
rename to crates/mcp/tests/it/cmdline_key.rs
index 77486e665..0f074beb2 100644
--- a/crates/mcp/tests/cmdline_key.rs
+++ b/crates/mcp/tests/it/cmdline_key.rs
@@ -1,5 +1,5 @@
 //! The headless backend answers `cmdline.key` like `cmdline.input` and like the app's control
-//! channel (`crates/ui-egui/tests/control_cmdline_key.rs`): a refused Enter is echoed and reported
+//! channel (`crates/ui-egui/tests/it/control_cmdline_key.rs`): a refused Enter is echoed and reported
 //! in `error`, and the call itself succeeds.
 
 use cadcraft_mcp::{Backend, Headless};
diff --git a/crates/mcp/tests/cmdline_parity.rs b/crates/mcp/tests/it/cmdline_parity.rs
similarity index 97%
rename from crates/mcp/tests/cmdline_parity.rs
rename to crates/mcp/tests/it/cmdline_parity.rs
index deaaa29fe..27209b570 100644
--- a/crates/mcp/tests/cmdline_parity.rs
+++ b/crates/mcp/tests/it/cmdline_parity.rs
@@ -1,5 +1,5 @@
 //! The headless backend answers `cmdline.input` and `app.open` with the same reply shape as the
-//! app's control channel (`cadcraft_ui_egui::control`, tested in `crates/ui-egui/tests/control_cmdline.rs`).
+//! app's control channel (`cadcraft_ui_egui::control`, tested in `crates/ui-egui/tests/it/control_cmdline.rs`).
 
 use cadcraft_mcp::{Backend, Headless};
 use serde_json::{Value, json};
diff --git a/crates/mcp/tests/control_methods.rs b/crates/mcp/tests/it/control_methods.rs
similarity index 94%
rename from crates/mcp/tests/control_methods.rs
rename to crates/mcp/tests/it/control_methods.rs
index da2727f13..f2f1ce037 100644
--- a/crates/mcp/tests/control_methods.rs
+++ b/crates/mcp/tests/it/control_methods.rs
@@ -1,5 +1,5 @@
 //! The headless backend's `control.methods` lists the methods it answers, all of them documented
-//! in `docs/control-protocol.md` (the app's list is tested in `crates/ui-egui/tests/control_methods.rs`).
+//! in `docs/control-protocol.md` (the app's list is tested in `crates/ui-egui/tests/it/control_methods.rs`).
 
 use std::collections::BTreeSet;
 
@@ -7,7 +7,7 @@ use cadcraft_mcp::{Backend, Headless};
 use serde_json::json;
 
 fn documented() -> BTreeSet<String> {
-    let doc = include_str!("../../../docs/control-protocol.md");
+    let doc = include_str!("../../../../docs/control-protocol.md");
     let table = doc.lines().skip_while(|l| !l.starts_with("| Method |")).skip(2).take_while(|l| l.starts_with('|'));
     table.filter_map(|l| l.split('|').nth(1)).flat_map(|cell| cell.split('`').skip(1).step_by(2).map(str::to_string).collect::<Vec<_>>()).collect()
 }
diff --git a/crates/mcp/tests/it/main.rs b/crates/mcp/tests/it/main.rs
new file mode 100644
index 000000000..850725748
--- /dev/null
+++ b/crates/mcp/tests/it/main.rs
@@ -0,0 +1,3 @@
+mod cmdline_key;
+mod cmdline_parity;
+mod control_methods;
diff --git a/crates/render/src/clip.rs b/crates/render/src/clip.rs
index 0b4c215df..73d89fdc3 100644
--- a/crates/render/src/clip.rs
+++ b/crates/render/src/clip.rs
@@ -215,7 +215,7 @@ pub fn boundary_polygon(k: &EntityKind) -> Option<Vec<Vec2>> {
             g.tessellate(r * e.ratio.min(1.0) * 2e-3, &mut pts);
         }
         EntityKind::Spline(s) => {
-            if s.control.len() > 100_000 || s.knots.len() > 100_000 {
+            if s.control.len() > 100_000 || s.knots.len() > 100_000 || s.degree > cadcraft_geom::MAX_SPLINE_DEGREE {
                 return None;
             }
             pts = s.tessellate(tol_for(Bounds2::from_points(s.control.iter().copied())));
diff --git a/crates/render/src/dim.rs b/crates/render/src/dim.rs
index f38e7ea0d..3a14aabc8 100644
--- a/crates/render/src/dim.rs
+++ b/crates/render/src/dim.rs
@@ -413,20 +413,61 @@ fn tol_height_code(st: &DimStyle) -> String {
     format!("{}x", format_decimal(f / 0.7, 4, 8, "."))
 }
 
+/// Apply measurement placeholders or append a dimension suffix, bounding the resulting UTF-8 text.
 fn post(template: &str, meas: &str) -> String {
-    if template.contains("<>") { template.replace("<>", meas) } else { format!("{meas}{template}") }
+    if template.contains("<>") {
+        bounded_replace(template, meas)
+    } else {
+        let mut out = String::new();
+        append_dim_text(&mut out, meas);
+        append_dim_text(&mut out, template);
+        out
+    }
 }
 
+/// Apply dimension text overrides: empty uses the base, whitespace suppresses text, and other text substitutes it.
 fn apply_override(base: &str, d: &Dimension) -> String {
     if d.text.is_empty() {
         base.to_string()
     } else if d.text.trim().is_empty() {
         String::new()
     } else {
-        d.text.replace("<>", base)
+        bounded_replace(&d.text, base)
     }
 }
 
+/// Largest dimension text produced by substituting the measurement into style/override text. Two
+/// modest strings can otherwise expand into gigabytes when the template holds many `<>` markers
+/// (CWE-789); past this the output is truncated rather than allocated unbounded.
+const MAX_DIM_TEXT: usize = 64 * 1024;
+
+/// Replace every `<>` in `template` with `value`, with the expanded length checked against
+/// [`MAX_DIM_TEXT`] before allocating so a many-placeholder template cannot blow up memory.
+fn bounded_replace(template: &str, value: &str) -> String {
+    let mut out = String::new();
+    let mut rest = template;
+    while let Some(i) = rest.find("<>") {
+        if !append_dim_text(&mut out, &rest[..i]) || !append_dim_text(&mut out, value) {
+            return out;
+        }
+        rest = &rest[i + 2..];
+    }
+    append_dim_text(&mut out, rest);
+    out
+}
+
+// Returns false when truncation consumed the remaining UTF-8-safe space.
+/// Append within the remaining dimension-text byte allowance without splitting a UTF-8 character.
+/// Return false if any input text had to be truncated.
+fn append_dim_text(out: &mut String, text: &str) -> bool {
+    let mut end = text.len().min(MAX_DIM_TEXT.saturating_sub(out.len()));
+    while !text.is_char_boundary(end) {
+        end -= 1;
+    }
+    out.push_str(&text[..end]);
+    end == text.len()
+}
+
 fn ext_line(origin: Vec2, foot: Vec2, st: &DimStyle, k: f64) -> Option<Vec<Vec2>> {
     let v = foot - origin;
     let len = v.len();
@@ -1322,3 +1363,23 @@ mod tests {
         assert!(g.lines.is_empty() && g.fills.is_empty(), "{:?}", g.lines);
     }
 }
+
+#[cfg(test)]
+mod text_budget_tests {
+    use super::*;
+    /// A dimension suffix without placeholders still obeys the total text limit.
+    #[test]
+    fn bounds_post_without_markers() {
+        let text = post(&"x".repeat(MAX_DIM_TEXT * 2), "12");
+        assert_eq!(text.len(), MAX_DIM_TEXT);
+        assert!(text.starts_with("12x"));
+    }
+    /// Oversized substituted text retains its prefix and ends at a valid UTF-8 boundary.
+    #[test]
+    fn oversized_value_is_substituted_and_truncated_at_a_character_boundary() {
+        let text = bounded_replace("prefix <> mm", &"é".repeat(MAX_DIM_TEXT));
+        assert!(text.starts_with("prefix é"));
+        assert!(!text.contains("<>"));
+        assert!(text.len() <= MAX_DIM_TEXT && text.len() >= MAX_DIM_TEXT - 1);
+    }
+}
diff --git a/crates/render/src/hatch.rs b/crates/render/src/hatch.rs
index e8d753757..dd83a71a2 100644
--- a/crates/render/src/hatch.rs
+++ b/crates/render/src/hatch.rs
@@ -79,19 +79,50 @@ fn same_polygon(a: &[Vec2], b: &[Vec2]) -> bool {
     (0..n).any(|k| (0..n).all(|i| near(a[i], b[(i + k) % n]))) || (0..n).any(|k| (0..n).all(|i| near(a[i], b[(k + n - (i % n)) % n])))
 }
 
+/// Remove degenerate and duplicate boundary loops within a shared comparison budget.
+/// Retain remaining loops without further comparisons once the budget is exhausted.
 fn dedup_polygons(loops: &mut Vec<Vec<Vec2>>) {
+    // `same_polygon` is O(n²) in a polygon's vertex count (every cyclic alignment, both windings),
+    // and each loop is compared against every unique one kept so far, so adversarial boundary
+    // geometry could force quadratic-on-quadratic work. Charge every vertex comparison against a
+    // shared budget; once it is spent, stop deduplicating and keep the remaining loops as-is
+    // (CWE-407).
+    let mut budget: u64 = MAX_DEDUP_COMPARISONS;
     let mut unique: Vec<Vec<Vec2>> = Vec::with_capacity(loops.len());
     for l in loops.drain(..) {
         if l.len() < 3 {
             continue;
         }
-        if !unique.iter().any(|u| same_polygon(u, &l)) {
+        let mut dup = false;
+        for u in &unique {
+            if u.len() != l.len() {
+                continue;
+            }
+            // Each `same_polygon` call costs about 2·len² comparisons; stop if that would overrun.
+            let cost = 2u64.saturating_mul((u.len() as u64).saturating_mul(l.len() as u64));
+            match budget.checked_sub(cost) {
+                Some(left) => budget = left,
+                None => {
+                    // Out of budget: keep `l` without further comparison.
+                    budget = 0;
+                    break;
+                }
+            }
+            if same_polygon(u, &l) {
+                dup = true;
+                break;
+            }
+        }
+        if !dup {
             unique.push(l);
         }
     }
     *loops = unique;
 }
 
+/// Vertex comparisons `dedup_polygons` may perform before it stops deduplicating.
+const MAX_DEDUP_COMPARISONS: u64 = 50_000_000;
+
 /// The tessellated boundary loops that take part in the fill under the hatch's island
 /// detection style (DXF group 75), filled with odd parity: 0 normal keeps every loop (islands
 /// within islands alternate), 1 outer keeps the outermost loops and their first islands, 2
@@ -261,6 +292,9 @@ const MAX_PATTERN_LINES: usize = 1024;
 /// (a hostile or mis-scaled pattern can't exhaust memory). A view-limited build makes at most the
 /// runs of a full build, so it never leaves out runs that a full build draws.
 const MAX_RUNS: usize = 1_000_000;
+/// Shared budget on dash-processing steps across all of a hatch's families and spans, counted
+/// independently of emitted geometry so gap-only patterns cannot spin without bound (CWE-400).
+const MAX_HATCH_WORK: u64 = 50_000_000;
 /// Upper bound on the lines one family sweeps over the whole hatch; past it the family is left
 /// out (a full-detail build of a pattern far too fine for its area).
 const MAX_FAMILY_LINES: i64 = 20_000;
@@ -351,7 +385,16 @@ pub(crate) fn pattern_lines_until(
     let scale = scale_of(h);
     let px = if px.is_finite() && px > 0.0 { px } else { 0.0 };
     let mut out = Vec::new();
+    // Shared work budget across all families and spans, counting dash-processing steps even when
+    // they emit no geometry: gap-only families produce no runs, so `out.len()` alone cannot bound
+    // their cost (CWE-400).
+    let mut work: u64 = MAX_HATCH_WORK;
     for fam in &lines {
+        // A family with dashes but no positive (ink) element can never draw: skip it so its gaps
+        // are not swept at all.
+        if !fam.dashes.is_empty() && !fam.dashes.iter().any(|d| *d >= 0.0) {
+            continue;
+        }
         let ang = fam.angle.to_radians() + h.angle;
         let origin = h.origin + Vec2::new(fam.origin.0, fam.origin.1).rotate(h.angle) * scale;
         let delta = Vec2::new(fam.delta.0, fam.delta.1).rotate(ang) * scale;
@@ -360,8 +403,8 @@ pub(crate) fn pattern_lines_until(
             continue;
         }
         let dashes: Vec<f64> = fam.dashes.iter().map(|d| d * scale).collect();
-        Family { origin, ang, delta, spacing, dashes: &dashes }.sweep(loops, px, view, cancel, &mut out);
-        if out.len() >= MAX_RUNS || is_set(cancel) {
+        Family { origin, ang, delta, spacing, dashes: &dashes }.sweep(loops, px, view, cancel, &mut out, &mut work);
+        if out.len() >= MAX_RUNS || work == 0 || is_set(cancel) {
             break;
         }
     }
@@ -422,7 +465,8 @@ impl Family<'_> {
         self.origin + p.rotate(self.ang)
     }
 
-    fn sweep(&self, loops: &[Vec<Vec2>], px: f64, view: Option<&Bounds2>, cancel: Option<&AtomicBool>, out: &mut Vec<Vec<Vec2>>) {
+    /// Intersect a pattern family with boundary loops, respecting view, output, cancellation, and shared dash-work limits.
+    fn sweep(&self, loops: &[Vec<Vec2>], px: f64, view: Option<&Bounds2>, cancel: Option<&AtomicBool>, out: &mut Vec<Vec<Vec2>>, work: &mut u64) {
         let local: Vec<Vec<Vec2>> = loops.iter().map(|l| l.iter().map(|p| self.to_local(*p)).collect()).collect();
         let bb = Bounds2::from_points(local.iter().flatten().copied());
         if bb.is_empty() {
@@ -456,7 +500,7 @@ impl Family<'_> {
         let draws = self.dashes.iter().any(|d| *d >= 0.0);
         let solid_line = self.dashes.is_empty() || pat_len < 1e-12 || (px > 0.0 && pat_len < 2.0 * px && draws);
         for k in k0..=k1 {
-            if out.len() >= MAX_RUNS || is_set(cancel) {
+            if out.len() >= MAX_RUNS || *work == 0 || is_set(cancel) {
                 return;
             }
             let y = k as f64 * self.spacing;
@@ -484,21 +528,22 @@ impl Family<'_> {
                 if solid_line {
                     out.push(vec![self.to_world(Vec2::new(x0, y)), self.to_world(Vec2::new(x1, y))]);
                 } else {
-                    self.dash(x0, x1, y, offset, pat_len, out);
+                    self.dash(x0, x1, y, offset, pat_len, out, work);
                 }
             }
         }
     }
 
     /// The dashes and dots of the span `x0..x1` of the line at `y`, phase anchored at x = `offset`.
-    fn dash(&self, x0: f64, x1: f64, y: f64, offset: f64, pat_len: f64, out: &mut Vec<Vec<Vec2>>) {
+    fn dash(&self, x0: f64, x1: f64, y: f64, offset: f64, pat_len: f64, out: &mut Vec<Vec<Vec2>>, work: &mut u64) {
         let start_rep = ((x0 - offset) / pat_len).floor();
         let mut x = offset + start_rep * pat_len;
         let mut guard = 0;
         'outer: while x < x1 {
             for d in self.dashes {
                 guard += 1;
-                if guard > 100_000 || out.len() >= MAX_RUNS {
+                *work = work.saturating_sub(1);
+                if guard > 100_000 || out.len() >= MAX_RUNS || *work == 0 {
                     break 'outer;
                 }
                 let len = d.abs();
@@ -560,3 +605,19 @@ mod tests {
         assert!((area - 100.0).abs() < 1e-6, "triangulated area must be 100.0, not zero");
     }
 }
+
+#[cfg(test)]
+mod dedup_budget_tests {
+    use super::*;
+    /// Loops with different vertex counts leave enough comparison fuel to remove a later duplicate.
+    #[test]
+    fn unequal_loops_do_not_spend_the_comparison_budget() {
+        // The old estimate exhausted the budget on this unequal pair before seeing the triangle.
+        let a = vec![Vec2::ZERO; 5_000];
+        let b = vec![Vec2::ZERO; 5_001];
+        let tri = vec![Vec2::ZERO, Vec2::new(1.0, 0.0), Vec2::new(0.0, 1.0)];
+        let mut loops = vec![a, b, tri.clone(), tri];
+        dedup_polygons(&mut loops);
+        assert_eq!(loops.len(), 3);
+    }
+}
diff --git a/crates/render/src/lib.rs b/crates/render/src/lib.rs
index b952fe18e..81da83585 100644
--- a/crates/render/src/lib.rs
+++ b/crates/render/src/lib.rs
@@ -735,13 +735,17 @@ fn contents(b: &mut Builder, d: &Drawing, vp: &cadcraft_doc::Viewport, area: Bou
         let eb = cadcraft_doc::entity_bounds(d, me, 0);
         eb.is_empty() || eb.intersects(&win)
     };
+    // One expansion budget for the whole build: seed it with what the enclosing list has already
+    // spent so a viewport's contents cannot start over with a fresh allowance and exceed the
+    // documented limit (CWE-400). Both the serial sub-builder and the parallel chunks share it.
+    let budget = std::sync::atomic::AtomicUsize::new(b.list.expanded);
     let mut sub = Builder {
         list: DisplayList::default(),
         opts: b.opts,
         plotting: b.plotting,
         styles: b.styles,
         named: None,
-        shared_budget: None,
+        shared_budget: Some(&budget),
         transparency: 0,
     };
     #[cfg(not(target_arch = "wasm32"))]
@@ -754,7 +758,6 @@ fn contents(b: &mut Builder, d: &Drawing, vp: &cadcraft_doc::Viewport, area: Bou
             // As `build_parallel`: chunks built side by side, joined in drawing order.
             use rayon::prelude::*;
             let ents: Vec<&std::sync::Arc<Entity>> = d.model.iter().collect();
-            let budget = std::sync::atomic::AtomicUsize::new(0);
             let opts = b.opts;
             let parts: Vec<DisplayList> = ents
                 .par_chunks(PARALLEL_CHUNK)
diff --git a/crates/render/src/linetype.rs b/crates/render/src/linetype.rs
index acd576dc9..1385a4d3d 100644
--- a/crates/render/src/linetype.rs
+++ b/crates/render/src/linetype.rs
@@ -94,8 +94,16 @@ pub fn ranges(len: f64, lt: &Linetype, scale: f64, min_pattern: f64) -> Option<V
     }
     let mut out = Vec::new();
     let mut pos = 0.0;
+    // Gap-only patterns draw nothing, matching `apply`, without walking every repeat.
+    if !lt.pattern.iter().any(|d| d.length >= 0.0) {
+        return Some(Vec::new());
+    }
+    // Bound the pattern elements visited, independent of emitted ranges, so a pattern that emits
+    // little still cannot cycle hundreds of millions of times.
+    let mut visits: u64 = 0;
     for d in lt.pattern.iter().map(|d| d.length * scale).cycle() {
-        if pos >= len || out.len() > 2_000_000 {
+        visits += 1;
+        if pos >= len || out.len() > 2_000_000 || visits > 4_000_000 {
             break;
         }
         if d >= 0.0 {
@@ -110,6 +118,14 @@ pub fn ranges(len: f64, lt: &Linetype, scale: f64, min_pattern: f64) -> Option<V
 mod tests {
     use super::*;
 
+    /// This gap-only pattern draws nothing, and `ranges` returns before cycling through its repeats.
+    #[test]
+    fn an_all_gap_pattern_draws_nothing_without_spinning() {
+        let lt = Linetype::simple("GAPS", "", &[-0.001, -0.002]);
+        assert_eq!(ranges(1.0, &lt, 1.0, 0.0), Some(Vec::new()));
+        assert!(apply(&[Vec2::ZERO, Vec2::new(1.0, 0.0)], &lt, 1.0, 0.0).is_empty());
+    }
+
     #[test]
     fn dashes_split_line() {
         let lt = Linetype::simple("DASHED", "", &[0.5, -0.25]);
diff --git a/crates/render/src/table.rs b/crates/render/src/table.rs
index b6a161aaf..5a571feff 100644
--- a/crates/render/src/table.rs
+++ b/crates/render/src/table.rs
@@ -53,17 +53,32 @@ pub struct TableGeom {
 
 /// Which cells are covered by a merge (and so not drawn on their own).
 pub fn table_covered(t: &Table) -> Vec<Vec<bool>> {
+    coverage(t).unwrap_or_else(|partial| partial)
+}
+
+// No partial coverage may reach owner assignment: it would revisit unbounded merge rectangles.
+/// Mark cells covered by merges under grid-size and marking-work limits.
+/// Return partial coverage as an error so layout can use its outline fallback instead of assigning owners.
+fn coverage(t: &Table) -> Result<Vec<Vec<bool>>, Vec<Vec<bool>>> {
     let rows = t.row_heights.len().min(10_000);
     let cols = t.col_widths.len().min(10_000);
     if rows.saturating_mul(cols) > MAX_LAYOUT_CELLS {
-        return vec![Vec::new(); rows];
+        return Err(vec![Vec::new(); rows]);
     }
     let mut cov = vec![vec![false; cols]; rows];
+    // Coverage marking visits each merge's whole rectangle. Overlapping merges re-mark cells that
+    // are already covered, so bound the total marking steps to a small multiple of the cell count
+    // rather than letting overlapping declarations cause quadratic work (CWE-407).
+    let mut budget: u64 = (rows as u64).saturating_mul(cols as u64).saturating_mul(4).saturating_add(1024);
     for (r, row) in t.cells.iter().enumerate().take(rows) {
         for (c, cell) in row.iter().enumerate().take(cols) {
             if let Some((rs, cs)) = cell.merged {
                 for rr in r..(r + rs.max(1) as usize).min(rows) {
                     for cc in c..(c + cs.max(1) as usize).min(cols) {
+                        budget = budget.saturating_sub(1);
+                        if budget == 0 {
+                            return Err(cov);
+                        }
                         if (rr, cc) != (r, c)
                             && let Some(x) = cov.get_mut(rr).and_then(|v| v.get_mut(cc))
                         {
@@ -74,7 +89,7 @@ pub fn table_covered(t: &Table) -> Vec<Vec<bool>> {
             }
         }
     }
-    cov
+    Ok(cov)
 }
 
 /// The table style a table uses (Standard defaults when missing).
@@ -134,19 +149,25 @@ pub fn table_geometry(d: &Drawing, t: &Table) -> TableGeom {
 /// One part of a broken table as a table of its own: its rows (with their cell styles) at
 /// `origin`; merges are cut at the part's edge.
 fn part_table(t: &Table, rows: &[usize], origin: Vec2) -> Table {
-    let cols = t.col_widths.len();
-    let mut cells: Vec<Vec<cadcraft_doc::TableCell>> = rows.iter().map(|r| t.cells.get(*r).cloned().unwrap_or_default()).collect();
-    for (i, row) in cells.iter_mut().enumerate() {
-        row.resize_with(cols, Default::default);
-        for cell in row.iter_mut() {
-            if let Some((rs, cs)) = cell.merged {
-                // Rows of the merge that follow in this part.
-                let start = rows.get(i).copied().unwrap_or(0);
-                let mut n = 1u32;
-                while n < rs && rows.get(i + n as usize).is_some_and(|r| *r == start + n as usize) {
-                    n += 1;
+    let cols = t.col_widths.len().min(10_000);
+    let mut cells: Vec<Vec<cadcraft_doc::TableCell>> =
+        rows.iter().take(10_000).map(|r| t.cells.get(*r).map(|row| row.iter().take(cols).cloned().collect()).unwrap_or_default()).collect();
+    // Only expand sparse rows to the full column count when detailed layout is actually permitted.
+    // Otherwise `layout` renders an outline, so materialising millions of empty cells here would be
+    // wasted work an attacker can trigger with a compact dimension array (CWE-789).
+    if rows.len().min(10_000).saturating_mul(cols) <= MAX_LAYOUT_CELLS {
+        for (i, row) in cells.iter_mut().enumerate() {
+            row.resize_with(cols, Default::default);
+            for cell in row.iter_mut() {
+                if let Some((rs, cs)) = cell.merged {
+                    // Rows of the merge that follow in this part.
+                    let start = rows.get(i).copied().unwrap_or(0);
+                    let mut n = 1u32;
+                    while n < rs && rows.get(i + n as usize).is_some_and(|r| *r == start + n as usize) {
+                        n += 1;
+                    }
+                    cell.merged = (n > 1 || cs > 1).then_some((n, cs));
                 }
-                cell.merged = (n > 1 || cs > 1).then_some((n, cs));
             }
         }
     }
@@ -180,7 +201,8 @@ fn layout(d: &Drawing, t: &Table) -> TableGeom {
     if rows == 0 || cols == 0 {
         return g;
     }
-    if rows.saturating_mul(cols) > MAX_LAYOUT_CELLS {
+    let cov = coverage(t);
+    if rows.saturating_mul(cols) > MAX_LAYOUT_CELLS || cov.is_err() {
         let (w, h) = (x_at(cols), y_at(rows));
         let corners = [p(0.0, 0.0), p(w, 0.0), p(w, h), p(0.0, h), p(0.0, 0.0)];
         for s in corners.windows(2) {
@@ -209,7 +231,7 @@ fn layout(d: &Drawing, t: &Table) -> TableGeom {
         i
     };
     // Anchors and the anchor owning each grid cell.
-    let cov = table_covered(t);
+    let cov = cov.unwrap_or_default();
     let mut anchors: Vec<Anchor> = Vec::new();
     let mut owner = vec![usize::MAX; rows * cols];
     for r in 0..rows {
@@ -369,3 +391,39 @@ pub(crate) fn draw(b: &mut Builder, ctx: &Ctx, t: &Table, rgb: Ink, lw: f32) {
         }
     }
 }
+
+#[cfg(test)]
+mod budget_tests {
+    use super::*;
+    use cadcraft_doc::TableCell;
+
+    /// Excessive overlapping merges draw only the table outline after coverage work is exhausted.
+    #[test]
+    fn overlapping_merges_use_outline_fallback() {
+        let t = Table {
+            row_heights: vec![1.0; 40],
+            col_widths: vec![1.0; 40],
+            cells: vec![vec![TableCell { merged: Some((40, 40)), ..Default::default() }; 40]; 40],
+            ..Default::default()
+        };
+        assert!(coverage(&t).is_err());
+        let g = layout(&Drawing::default(), &t);
+        assert_eq!(g.lines.len(), 4);
+        assert!(g.fills.is_empty() && g.texts.is_empty());
+    }
+
+    /// A split table within the displayed-cell budget clips a merge to contiguous selected rows.
+    #[test]
+    fn part_clips_merges_using_displayed_column_count() {
+        let t = Table {
+            row_heights: vec![1.0; 102],
+            col_widths: vec![1.0; 10_001],
+            cells: vec![vec![TableCell { merged: Some((100, 1)), ..Default::default() }]],
+            ..Default::default()
+        };
+        let mut rows: Vec<_> = (0..99).collect();
+        rows.push(101);
+        let part = part_table(&t, &rows, Vec2::ZERO);
+        assert_eq!(part.cells[0][0].merged, Some((99, 1)));
+    }
+}
diff --git a/crates/render/tests/aci7_display.rs b/crates/render/tests/it/aci7_display.rs
similarity index 100%
rename from crates/render/tests/aci7_display.rs
rename to crates/render/tests/it/aci7_display.rs
diff --git a/crates/render/tests/annotative_viewport.rs b/crates/render/tests/it/annotative_viewport.rs
similarity index 100%
rename from crates/render/tests/annotative_viewport.rs
rename to crates/render/tests/it/annotative_viewport.rs
diff --git a/crates/render/tests/dim_angular_centre.rs b/crates/render/tests/it/dim_angular_centre.rs
similarity index 100%
rename from crates/render/tests/dim_angular_centre.rs
rename to crates/render/tests/it/dim_angular_centre.rs
diff --git a/crates/render/tests/dim_post_tolerance.rs b/crates/render/tests/it/dim_post_tolerance.rs
similarity index 100%
rename from crates/render/tests/dim_post_tolerance.rs
rename to crates/render/tests/it/dim_post_tolerance.rs
diff --git a/crates/render/tests/dim_text_format.rs b/crates/render/tests/it/dim_text_format.rs
similarity index 100%
rename from crates/render/tests/dim_text_format.rs
rename to crates/render/tests/it/dim_text_format.rs
diff --git a/crates/render/tests/hatch_fill.rs b/crates/render/tests/it/hatch_fill.rs
similarity index 100%
rename from crates/render/tests/hatch_fill.rs
rename to crates/render/tests/it/hatch_fill.rs
diff --git a/crates/render/tests/linetype_text.rs b/crates/render/tests/it/linetype_text.rs
similarity index 100%
rename from crates/render/tests/linetype_text.rs
rename to crates/render/tests/it/linetype_text.rs
diff --git a/crates/render/tests/lwdefault.rs b/crates/render/tests/it/lwdefault.rs
similarity index 100%
rename from crates/render/tests/lwdefault.rs
rename to crates/render/tests/it/lwdefault.rs
diff --git a/crates/render/tests/it/main.rs b/crates/render/tests/it/main.rs
new file mode 100644
index 000000000..7469173d0
--- /dev/null
+++ b/crates/render/tests/it/main.rs
@@ -0,0 +1,17 @@
+mod aci7_display;
+mod annotative_viewport;
+mod dim_angular_centre;
+mod dim_post_tolerance;
+mod dim_text_format;
+mod hatch_fill;
+mod linetype_text;
+mod lwdefault;
+mod plot_line_styles;
+mod plot_styles;
+mod point_style;
+mod psltscale;
+mod raster_points;
+mod render_props;
+mod viewport_frozen_layer;
+mod wide_pline_linetype;
+mod wipeout_mask;
diff --git a/crates/render/tests/plot_line_styles.rs b/crates/render/tests/it/plot_line_styles.rs
similarity index 100%
rename from crates/render/tests/plot_line_styles.rs
rename to crates/render/tests/it/plot_line_styles.rs
diff --git a/crates/render/tests/plot_styles.rs b/crates/render/tests/it/plot_styles.rs
similarity index 100%
rename from crates/render/tests/plot_styles.rs
rename to crates/render/tests/it/plot_styles.rs
diff --git a/crates/render/tests/point_style.rs b/crates/render/tests/it/point_style.rs
similarity index 100%
rename from crates/render/tests/point_style.rs
rename to crates/render/tests/it/point_style.rs
diff --git a/crates/render/tests/psltscale.rs b/crates/render/tests/it/psltscale.rs
similarity index 100%
rename from crates/render/tests/psltscale.rs
rename to crates/render/tests/it/psltscale.rs
diff --git a/crates/render/tests/raster_points.rs b/crates/render/tests/it/raster_points.rs
similarity index 100%
rename from crates/render/tests/raster_points.rs
rename to crates/render/tests/it/raster_points.rs
diff --git a/crates/render/tests/render_props.rs b/crates/render/tests/it/render_props.rs
similarity index 100%
rename from crates/render/tests/render_props.rs
rename to crates/render/tests/it/render_props.rs
diff --git a/crates/render/tests/viewport_frozen_layer.rs b/crates/render/tests/it/viewport_frozen_layer.rs
similarity index 100%
rename from crates/render/tests/viewport_frozen_layer.rs
rename to crates/render/tests/it/viewport_frozen_layer.rs
diff --git a/crates/render/tests/wide_pline_linetype.rs b/crates/render/tests/it/wide_pline_linetype.rs
similarity index 100%
rename from crates/render/tests/wide_pline_linetype.rs
rename to crates/render/tests/it/wide_pline_linetype.rs
diff --git a/crates/render/tests/wipeout_mask.rs b/crates/render/tests/it/wipeout_mask.rs
similarity index 100%
rename from crates/render/tests/wipeout_mask.rs
rename to crates/render/tests/it/wipeout_mask.rs
diff --git a/crates/ui-egui/Cargo.toml b/crates/ui-egui/Cargo.toml
index 630188d73..18721a963 100644
--- a/crates/ui-egui/Cargo.toml
+++ b/crates/ui-egui/Cargo.toml
@@ -23,6 +23,7 @@ egui-wgpu = { workspace = true }
 serde = { workspace = true }
 serde_json = { workspace = true }
 log = { workspace = true }
+chrono = { workspace = true }
 image = { workspace = true }
 
 [dev-dependencies]
diff --git a/crates/ui-egui/src/autosave.rs b/crates/ui-egui/src/autosave.rs
index c7ea384d7..a0db8d0d7 100644
--- a/crates/ui-egui/src/autosave.rs
+++ b/crates/ui-egui/src/autosave.rs
@@ -111,23 +111,36 @@ impl CadApp {
     }
 }
 
-/// `secs` since 1970 as `YYYY-MM-DD HH:MM` (UTC).
+/// `secs` since 1970 as `YYYY-MM-DD HH:MM` (UTC). Past chrono's year 262143 range the proleptic
+/// Gregorian date is kept via the 400-year cycle rather than falling back to the epoch.
 fn utc(secs: u64) -> String {
-    let days = (secs / 86_400) as i64;
     let (h, m) = ((secs % 86_400) / 3600, (secs % 3600) / 60);
-    // Civil date from days since 1970-01-01 (Howard Hinnant's algorithm).
-    let z = days + 719_468;
-    let era = z.div_euclid(146_097);
-    let doe = z - era * 146_097;
-    let yoe = (doe - doe / 1460 + doe / 36_524 - doe / 146_096) / 365;
-    let doy = doe - (365 * yoe + yoe / 4 - yoe / 100);
-    let mp = (5 * doy + 2) / 153;
-    let d = doy - (153 * mp + 2) / 5 + 1;
-    let mo = if mp < 10 { mp + 3 } else { mp - 9 };
-    let y = yoe + era * 400 + i64::from(mo <= 2);
+    let (y, mo, d) = civil_from_days(secs / 86_400);
+    // `{y:04}` rather than `%Y`, which writes a `+` before years past 9999.
     format!("{y:04}-{mo:02}-{d:02} {h:02}:{m:02}")
 }
 
+/// Days since 1970-01-01 → proleptic Gregorian (year, month, day).
+///
+/// A recovery file's mtime can in principle land past `NaiveDate`'s ±262143-year range; the old
+/// hand-rolled converter still produced a date there, so falling back to the epoch would change
+/// the shown time. The Gregorian calendar repeats every 400 years (146_097 days), so chrono
+/// converts the day within one cycle and whole cycles go back into the year (an `i128`, then
+/// saturated into `i64`), keeping chrono as the only calendar logic and reproducing the old
+/// result exactly. 1970-01-01 is `num_days_from_ce` 719_163.
+fn civil_from_days(days: u64) -> (i64, u32, u32) {
+    use chrono::Datelike;
+    let (cycles, rest) = (days / 146_097, days % 146_097);
+    // `rest + 719_163` is 719_163..865_259, always a valid CE day.
+    match i32::try_from(rest + 719_163).ok().and_then(chrono::NaiveDate::from_num_days_from_ce_opt) {
+        Some(d) => {
+            let y = i128::from(d.year()) + i128::from(cycles) * 400;
+            (i64::try_from(y).unwrap_or(i64::MAX), d.month(), d.day())
+        }
+        None => (1970, 1, 1), // unreachable
+    }
+}
+
 /// The Drawing Recovery window, while autosave files from a crash are waiting.
 pub fn show(app: &mut CadApp, ctx: &egui::Context) {
     if app.recovery.items.is_empty() {
@@ -233,5 +246,9 @@ mod tests {
         assert_eq!(super::utc(0), "1970-01-01 00:00");
         assert_eq!(super::utc(951_782_400 + 3_660), "2000-02-29 01:01");
         assert_eq!(super::utc(1_791_676_800), "2026-10-11 00:00");
+        assert_eq!(super::utc(253_402_300_800), "10000-01-01 00:00");
+        // Past chrono's range the proleptic Gregorian date is kept, not the epoch (old output).
+        assert_eq!(super::utc(10_000_000_000_000), "318857-05-20 17:46");
+        assert_eq!(super::utc(u64::MAX), "584554051223-11-09 07:00");
     }
 }
diff --git a/crates/ui-egui/src/control.rs b/crates/ui-egui/src/control.rs
index 03a35212f..bc6d23ef5 100644
--- a/crates/ui-egui/src/control.rs
+++ b/crates/ui-egui/src/control.rs
@@ -187,7 +187,7 @@ fn wrap(r: Result<Value, String>) -> Outcome {
 }
 
 /// What `control.methods` replies: method, params, description. Keep in step with `handle` and the
-/// table in `docs/control-protocol.md` (`tests/control_methods.rs` checks the table).
+/// table in `docs/control-protocol.md` (`tests/it/control_methods.rs` checks the table).
 const METHODS: &[(&str, &str, &str)] = &[
     ("cmdline.input", "{text}", "Type a line at the command line exactly like a user (commands, prompts, keywords; empty = Enter)."),
     ("cmdline.script", "{text}", "Run a multi-line script, like a .scr file."),
diff --git a/crates/ui-egui/src/i18n/tests.rs b/crates/ui-egui/src/i18n/tests.rs
index bbbcded39..7044017d3 100644
--- a/crates/ui-egui/src/i18n/tests.rs
+++ b/crates/ui-egui/src/i18n/tests.rs
@@ -9,6 +9,11 @@ fn placeholders(text: &str) -> BTreeSet<&str> {
     text.split('{').skip(1).filter_map(|s| s.split_once('}').map(|(key, _)| key)).collect()
 }
 
+/// Languages with a catalog (every one but English).
+fn translated() -> impl Iterator<Item = &'static Language> {
+    LANGUAGES.iter().filter(|l| !l.source.is_empty())
+}
+
 #[test]
 fn catalog_is_valid_and_preserves_placeholders_and_ellipses() {
     for language in &LANGUAGES {
@@ -27,32 +32,30 @@ fn catalog_is_valid_and_preserves_placeholders_and_ellipses() {
                 }
             }
         }
+        assert_eq!(tr(language.code, "a future untranslated label"), "a future untranslated label");
     }
     let (parsed, errors) = parse("broken\n\tOpen\tВідкрити\n\tOpen\tВідкрити\n\tEmpty\t\n");
     assert_eq!(parsed.len(), 1);
     assert_eq!(errors.len(), 3);
-    assert_eq!(tr("uk", "a future untranslated label"), "a future untranslated label");
     assert_eq!(tr("unknown", "Open"), "Open");
 }
 
-/// Ukrainian is the reference translation and must cover everything. Other languages fall back
-/// to English for what they don't cover yet; their gaps are reported, not enforced, so adding a
-/// command doesn't require a row in every language.
-const REQUIRED: &[&str] = &["uk"];
-const REPORTED: &[&str] = &["pt-BR", "de", "es", "cs", "ru", "fr", "zh", "it", "ko", "sv", "ar", "hu", "tr", "el"];
-
-fn check(language: &str, what: &str, missing: Vec<String>) {
-    if REQUIRED.contains(&language) {
-        assert!(missing.is_empty(), "{language}: missing {what}: {missing:?}");
-    } else if !missing.is_empty() {
-        eprintln!("{language}: {} {what} fall back to English: {missing:?}", missing.len());
-    }
-}
-
+/// What each language shows in English for now. Missing translations never fail a build:
+/// `cargo xtask i18n`, a step of `cargo xtask ci`, runs this to print the list.
 #[test]
-fn translations_cover_commands_menus_tools_and_snap_labels() {
-    for language in REQUIRED.iter().chain(REPORTED) {
-        check(language, "translations", missing_commands_menus_tools_and_snap_labels(language));
+#[ignore = "a report, printed by `cargo xtask i18n`"]
+fn translation_gaps() {
+    for language in translated() {
+        let mut missing: BTreeSet<String> = missing_commands_menus_tools_and_snap_labels(language.code).into_iter().collect();
+        missing.extend(missing_marked_ui_literals(language.code));
+        if missing.is_empty() {
+            println!("{}: nothing missing", language.code);
+            continue;
+        }
+        println!("{}: {} strings fall back to English", language.code, missing.len());
+        for source in &missing {
+            println!("  {source}");
+        }
     }
 }
 
@@ -78,13 +81,6 @@ fn missing_commands_menus_tools_and_snap_labels(language: &str) -> Vec<String> {
     sources.into_iter().filter(|s| !s.is_empty() && !catalog.contains_key(&("", *s))).map(str::to_string).collect()
 }
 
-#[test]
-fn every_marked_ui_literal_has_a_translation() {
-    for language in REQUIRED.iter().chain(REPORTED) {
-        check(language, "UI translations", missing_marked_ui_literals(language).into_iter().collect());
-    }
-}
-
 fn missing_marked_ui_literals(language: &str) -> BTreeSet<String> {
     let catalog = catalog(language).unwrap();
     let sources = [
@@ -155,27 +151,38 @@ fn locale_and_saved_preference_resolution() {
     for (tag, code) in [("ru", "ru"), ("ru-RU", "ru"), ("ru_RU.UTF-8", "ru"), ("fr", "fr"), ("fr-FR", "fr"), ("fr_CA.UTF-8", "fr")] {
         assert_eq!(locale_language(tag), Some(code), "{tag}");
     }
-    for tag in ["ua", "ukulele", "pl-PL", "", "garbage", "💙"] {
-        assert_eq!(locale_language(tag), None, "{tag}");
-    }
     for tag in ["pt", "pt-BR", "pt_BR.UTF-8", "PT-br", "pt-PT"] {
         assert_eq!(locale_language(tag), Some("pt-BR"), "{tag}");
     }
-    assert_eq!(locale_language("ptolemy"), None);
-    assert_eq!(Preference::Auto.resolve(&["pl-PL".into(), "pt-BR".into()]), "pt-BR");
-    assert_eq!(Preference::Auto.resolve(&["fr-FR".into(), "pt-BR".into()]), "fr");
     for tag in ["es", "es-ES", "es_MX.UTF-8", "ES-ar"] {
         assert_eq!(locale_language(tag), Some("es"), "{tag}");
     }
+    for (code, tags) in [
+        ("cs", &["cs", "cs-CZ", "cs_CZ.UTF-8", "CS-cz", " cs-CZ ", "cs_CZ@euro"][..]),
+        ("it", &["it", "it-IT", "it_IT.UTF-8", "IT-ch", " it-CH ", "it_IT@euro"]),
+        ("ko", &["ko", "ko-KR", "ko_KR.UTF-8", "KO-kr", " ko-KR ", "ko_KR@euro"]),
+        ("sv", &["sv", "sv-SE", "sv_SE.UTF-8", "SV-se", " sv-SE ", "sv-FI"]),
+        ("hu", &["hu", "hu-HU", "hu_HU.UTF-8", "HU-hu", " hu-HU "]),
+        ("tr", &["tr", "tr-TR", "tr_TR.UTF-8", "TR-tr", " tr-TR ", "tr-CY"]),
+        ("el", &["el", "el-GR", "el_GR.UTF-8", "EL-cy"]),
+        ("zh", &["zh", "zh-CN"]),
+    ] {
+        for tag in tags {
+            assert_eq!(locale_language(tag), Some(code), "{tag}");
+        }
+    }
+    // Look-alike codes, three-letter codes and endonyms pick nothing: `se` is Northern Sami.
+    let look_alikes = ["ua", "ukulele", "pl-PL", "", "garbage", "💙", "ptolemy", "cz", "csharp", "csomething", "italic"];
+    let others = ["kr", "korean", "kotlin", "se", "swe", "svenska", "hun", "magyar", "tur", "türkçe", "elvish"];
+    for tag in look_alikes.into_iter().chain(others) {
+        assert_eq!(locale_language(tag), None, "{tag}");
+    }
+    assert_eq!(Preference::Auto.resolve(&["pl-PL".into(), "pt-BR".into()]), "pt-BR");
+    assert_eq!(Preference::Auto.resolve(&["fr-FR".into(), "pt-BR".into()]), "fr");
     assert_eq!(Preference::Auto.resolve(&["es-ES".into(), "pt-BR".into()]), "es");
-    assert_eq!(Preference::parse("es"), Some(Preference::Spanish));
-    assert_eq!(Preference::BrazilianPortuguese.resolve(&["uk-UA".into()]), "pt-BR");
-    assert_eq!(Preference::parse("pt-BR"), Some(Preference::BrazilianPortuguese));
     let locales = vec!["pl-PL".into(), "uk-UA".into(), "en-US".into()];
     assert_eq!(Preference::Auto.resolve(&locales), "uk");
     assert_eq!(Preference::English.resolve(&locales), "en");
-    assert_eq!(Preference::German.resolve(&locales), "de");
-    assert_eq!(Preference::Auto.resolve(&["de-DE".into(), "en-US".into()]), "de");
     assert_eq!(Preference::Auto.resolve(&["en-US".into(), "uk-UA".into()]), "en");
     assert_eq!(Preference::Auto.resolve(&[]), "en");
     assert_eq!(Preference::restore(None), Preference::Auto);
@@ -183,122 +190,83 @@ fn locale_and_saved_preference_resolution() {
     for preference in Preference::ALL {
         assert_eq!(Preference::restore(Some(preference.code())), preference);
         let saved = serde_json::to_string(&preference).unwrap();
+        assert_eq!(saved, format!("\"{}\"", preference.code()));
         assert_eq!(serde_json::from_str::<Preference>(&saved).unwrap(), preference);
+        if preference == Preference::Auto {
+            continue;
+        }
+        assert_eq!(Preference::parse(preference.code()), Some(preference));
+        // A chosen language wins over the system's; Auto takes the first system language there is.
+        assert_eq!(preference.resolve(&["uk-UA".into()]), preference.code());
+        if preference != Preference::English {
+            assert_eq!(Preference::Auto.resolve(&["pl-PL".into(), preference.code().into(), "en-US".into()]), preference.code());
+        }
+        // Saved with the host's other preferences; a bad saved value keeps the current choice.
+        let mut a = CadApp::new(Session::new(), Services::default());
+        a.ui.interface_language = preference;
+        let mut b = CadApp::new(Session::new(), Services::default());
+        b.load_prefs(&a.prefs_json());
+        assert_eq!(b.ui.interface_language, preference);
+        b.load_prefs(r#"{"interfaceLanguage":"klingon"}"#);
+        assert_eq!(b.ui.interface_language, preference);
     }
     assert!(serde_json::from_str::<Preference>("\"unsupported\"").is_err());
     assert_eq!(serde_json::from_value::<crate::UiState>(json!({})).unwrap().interface_language, Preference::Auto);
-    // Saved with the host's other preferences; a bad saved value keeps the current choice.
-    let mut a = CadApp::new(Session::new(), Services::default());
-    a.ui.interface_language = Preference::Ukrainian;
-    let mut b = CadApp::new(Session::new(), Services::default());
-    b.load_prefs(&a.prefs_json());
-    assert_eq!(b.ui.interface_language, Preference::Ukrainian);
-    b.load_prefs(r#"{"interfaceLanguage":"klingon"}"#);
-    assert_eq!(b.ui.interface_language, Preference::Ukrainian);
 }
 
 #[test]
-fn plural_forms_and_templates_preserve_inserted_user_data() {
-    with_language("uk", || {
-        for (n, form) in [
-            (0, 2),
-            (1, 0),
-            (2, 1),
-            (4, 1),
-            (5, 2),
-            (11, 2),
-            (12, 2),
-            (14, 2),
-            (21, 0),
-            (22, 1),
-            (25, 2),
-            (101, 0),
-            (111, 2),
-            (114, 2),
-            (u64::MAX, 2),
-        ] {
-            assert_eq!(plural_uk(n), form, "{n}");
+fn plural_rules_pick_the_cldr_form() {
+    let uk = [0, 1, 2, 4, 5, 11, 12, 14, 21, 22, 25, 101, 111, 114, u64::MAX].map(plural_uk);
+    assert_eq!(uk, [2, 0, 1, 1, 2, 2, 2, 2, 0, 1, 2, 0, 2, 2, 2]);
+    assert_eq!([0, 1, 2, 5, 21, u64::MAX].map(plural_pt), [0, 0, 1, 1, 1, 1]);
+    assert_eq!([0, 1, 2, 4, 5, 11, 21, 22, 25, u64::MAX].map(plural_cs), [2, 0, 1, 1, 2, 2, 2, 2, 2, 2]);
+    for language in &LANGUAGES {
+        for n in [0, 1, 2, 3, 5, 11, 21, 22, 101, 111, u64::MAX] {
+            assert!((language.plural)(n) < language.plural_forms, "{}: {n}", language.code);
         }
-        assert_eq!(count(1, "{n} contributor", "{n} contributors"), "1 учасник");
-        assert_eq!(count(22, "{n} contributor", "{n} contributors"), "22 учасники");
-        assert_eq!(count(11, "{n} contributor", "{n} contributors"), "11 учасників");
-        assert_eq!(format("Current: {color}", &[("color", "{n} Open".into())]), "Поточний: {n} Open");
-        assert_eq!(format("{b}/{a}", &[("a", "А".into()), ("b", "Б".into())]), "Б/А");
-    });
-    assert_eq!(t("Layers"), "Layers");
-    with_language("de", || {
-        assert_eq!(t("Layers"), "Layer");
-        assert_eq!(count(1, "{n} contributor", "{n} contributors"), "1 Mitwirkender");
-        assert_eq!(count(2, "{n} contributor", "{n} contributors"), "2 Mitwirkende");
-        assert_eq!(count(11, "{n} contributor", "{n} contributors"), "11 Mitwirkende");
-    });
-    with_language("uk", || {
-        assert_eq!(t("Layers"), "Шари");
-        with_language("en", || assert_eq!(t("Layers"), "Layers"));
-        assert_eq!(t("Layers"), "Шари");
-    });
-    assert_eq!(count(2, "{n} contributor", "{n} contributors"), "2 contributors");
-}
-
-#[test]
-fn brazilian_portuguese_plurals_and_accents() {
-    for (n, form) in [(0, 0), (1, 0), (2, 1), (5, 1), (21, 1), (u64::MAX, 1)] {
-        assert_eq!(plural_pt(n), form, "{n}");
     }
-    with_language("pt-BR", || {
-        assert_eq!(count(1, "{n} contributor", "{n} contributors"), "1 colaborador");
-        assert_eq!(count(3, "{n} contributor", "{n} contributors"), "3 colaboradores");
-        assert_eq!(t("Layers"), "Camadas");
-        assert_eq!(t("Dimension"), "Cota");
-        assert_eq!(format("Height: {height}", &[("height", "{n}".into())]), "Altura: {n}");
-    });
-    assert_eq!(count(2, "{n} contributor", "{n} contributors"), "2 contributors");
 }
 
 #[test]
-fn live_switch_to_brazilian_portuguese_translates_the_shell() {
-    let mut app = CadApp::new(Session::new(), Services::default());
-    app.ui.in_window_menu = true;
-    let ctx = egui::Context::default();
-    app.logic(&ctx);
-    app.start("line");
-    app.run("ui.language", json!({"lang":"pt-BR"})).unwrap();
-    let text = render(&mut app, &ctx);
-    assert!(text.contains("Propriedades"), "{text}");
-    assert!(text.contains("Arquivo"), "{text}");
-    assert_eq!(app.language(), "pt-BR");
-    assert_eq!(t("Properties"), "Properties", "language must not leak out of the render scope");
-    app.run("ui.language", json!({"lang":"en"})).unwrap();
-    assert!(render(&mut app, &ctx).contains("Properties"));
+fn counts_and_templates_follow_each_catalog_and_keep_inserted_text() {
+    for language in &LANGUAGES {
+        with_language(language.code, || {
+            for (one, other) in [("{n} contributor", "{n} contributors"), ("{n} commit", "{n} commits")] {
+                for n in [0, 1, 2, 3, 5, 11, 21, 22, 101, u64::MAX] {
+                    let form =
+                        catalog(language.code).and_then(|c| c.get(&("@plural", one))).and_then(|forms| forms.split('|').nth((language.plural)(n)));
+                    let expected = form.unwrap_or(if n == 1 { one } else { other }).replace("{n}", &n.to_string());
+                    assert_eq!(count(n, one, other), expected, "{}: {n}", language.code);
+                }
+            }
+            // Inserted values are never looked up or substituted again.
+            assert_eq!(format("Current: {color}", &[("color", "{n} Open".into())]), t("Current: {color}").replace("{color}", "{n} Open"));
+            assert_eq!(format("{b}/{a}", &[("a", "А".into()), ("b", "Б".into())]), "Б/А");
+        });
+    }
+    with_language("uk", || {
+        let layers = t("Layers");
+        with_language("en", || assert_eq!(t("Layers"), "Layers"));
+        assert_eq!(t("Layers"), layers);
+    });
+    assert_eq!(t("Layers"), "Layers", "language must not leak out of a render scope");
+    assert_eq!(count(2, "{n} contributor", "{n} contributors"), "2 contributors");
 }
 
 #[test]
 fn the_wcs_pill_draws_its_arrow_instead_of_a_glyph_a_font_may_lack() {
     // #1541: "WCS ⌄" showed a box where the UI font had no "⌄"; the chevron is now drawn as
     // lines, so no catalog and no language paints the glyph.
-    for (name, catalog) in [
-        ("ar", include_str!("ar.tsv")),
-        ("cs", include_str!("cs.tsv")),
-        ("de", include_str!("de.tsv")),
-        ("es", include_str!("es.tsv")),
-        ("fr", include_str!("fr.tsv")),
-        ("it", include_str!("it.tsv")),
-        ("ko", include_str!("ko.tsv")),
-        ("pt_br", include_str!("pt_br.tsv")),
-        ("ru", include_str!("ru.tsv")),
-        ("sv", include_str!("sv.tsv")),
-        ("uk", include_str!("uk.tsv")),
-        ("zh", include_str!("zh.tsv")),
-    ] {
-        assert!(!catalog.contains('\u{2304}'), "{name}.tsv still has the \u{2304} glyph");
-    }
     let ctx = egui::Context::default();
     let mut app = CadApp::new(Session::new(), Services::default());
-    for (lang, label) in [("en", "WCS"), ("de", "WKS"), ("ru", "МСК")] {
-        app.run("ui.language", json!({ "lang": lang })).unwrap();
+    for language in &LANGUAGES {
+        assert!(!language.source.contains('\u{2304}'), "{}.tsv still has the \u{2304} glyph", language.code);
+        app.run("ui.language", json!({ "lang": language.code })).unwrap();
+        app.logic(&ctx);
+        let label = tr(app.language(), "WCS");
         let text = render(&mut app, &ctx);
-        assert!(text.lines().any(|l| l == label), "{lang}: the pill reads {label}");
-        assert!(!text.contains('\u{2304}'), "{lang}: no \u{2304} glyph is painted");
+        assert!(text.lines().any(|l| l == label), "{}: the pill reads {label}", language.code);
+        assert!(!text.contains('\u{2304}'), "{}: no \u{2304} glyph is painted", language.code);
     }
 }
 
@@ -343,273 +311,115 @@ fn live_switch_translates_the_shell_without_mutating_drawing_or_automation() {
     app.session.state_mut().unwrap().title = "Open".into();
     let ctx = egui::Context::default();
     app.logic(&ctx);
-    let before = render(&mut app, &ctx);
-    assert!(before.contains("Properties"));
+    assert!(render(&mut app, &ctx).contains("Properties"));
     let commands = crate::control::all_commands(&app);
     let (menu_request, _) = crate::ControlRequest::new("ui.menu.list", json!({}));
     let crate::control::Outcome::Done(menu_before) = crate::control::handle(&mut app, &ctx, &menu_request) else { panic!("expected menu reply") };
     app.start("line");
     let prompt = crate::control::cmdline_state(&app);
-    app.run("ui.language", json!({"lang":"uk"})).unwrap();
-    let after = render(&mut app, &ctx);
-    assert!(after.contains("Властивості"), "{after}");
-    assert!(after.contains("Файл"), "{after}");
-    assert!(after.contains("Укажіть першу точку"), "{after}");
-    assert!(after.contains("Open"), "the drawing title must remain unchanged");
-    assert_eq!(crate::control::cmdline_state(&app), prompt);
-    assert_eq!(crate::control::all_commands(&app), commands);
-    let crate::control::Outcome::Done(menu_after) = crate::control::handle(&mut app, &ctx, &menu_request) else { panic!("expected menu reply") };
-    assert_eq!(menu_before, menu_after);
-    assert_eq!(app.session.state().unwrap().title, "Open");
-    assert_eq!(t("Properties"), "Properties", "language must not leak out of the render scope");
-    assert!(app.run("ui.language", json!({"lang":"bad"})).is_err());
-    assert_eq!(app.language(), "uk");
-    app.run("ui.resetpalettes", json!({})).unwrap();
-    assert_eq!(app.language(), "uk");
-    app.run("ui.language", json!({"lang":"en"})).unwrap();
+    for language in translated() {
+        app.run("ui.language", json!({ "lang": language.code })).unwrap();
+        app.logic(&ctx);
+        // Without a font for its script, a language stays chosen and the interface shows English.
+        let shown = app.language();
+        assert_eq!(shown, if crate::theme::can_show(language.code) { language.code } else { "en" });
+        assert_eq!(app.fonts_language, Some(shown));
+        let text = render(&mut app, &ctx);
+        for source in ["Properties", "File"] {
+            assert!(text.contains(tr(shown, source)), "{}: {source}: {text}", language.code);
+        }
+        assert!(text.contains("Open"), "the drawing title must remain unchanged");
+        assert_eq!(crate::control::cmdline_state(&app), prompt);
+        assert_eq!(crate::control::all_commands(&app), commands);
+        let crate::control::Outcome::Done(menu_after) = crate::control::handle(&mut app, &ctx, &menu_request) else { panic!("expected menu reply") };
+        assert_eq!(menu_before, menu_after);
+        assert_eq!(app.session.state().unwrap().title, "Open");
+        assert_eq!(t("Properties"), "Properties", "language must not leak out of the render scope");
+        assert!(app.run("ui.language", json!({"lang":"bad"})).is_err());
+        app.run("ui.resetpalettes", json!({})).unwrap();
+        assert_eq!(app.language(), shown);
+    }
+    // The general ui.set route saves the same preference and installs the same fonts.
+    for code in ["ko", "zh", "en"] {
+        let (request, _) = crate::ControlRequest::new("ui.set", json!({ "interfaceLanguage": code }));
+        let _ = crate::control::handle(&mut app, &ctx, &request);
+        assert_eq!(app.ui.interface_language, Preference::parse(code).unwrap());
+        app.logic(&ctx);
+        assert_eq!(app.fonts_language, Some(app.language()));
+        render(&mut app, &ctx);
+    }
     assert!(render(&mut app, &ctx).contains("Properties"));
     // The menu tree used by the control channel keeps its original labels and IDs.
     assert_eq!(crate::menus::tree(&app).first().unwrap().0, "File");
 }
 
 #[test]
-fn dialogs_render_in_ukrainian_and_keep_their_source_ids() {
-    for (dialog, heading) in [
-        ("dsettings", "Налаштування креслення"),
-        ("about", "Про CADCraft"),
-        ("commands", "Довідник команд"),
-        ("blocks", "Блоки"),
-        ("layers", "Диспетчер властивостей шарів"),
-        ("qselect", "Швидкий вибір"),
-        ("parameters", "Диспетчер параметрів"),
-        ("language", "Мова інтерфейсу"),
-        ("hatch", "Штрихування та градієнт"),
-    ] {
-        let mut app = CadApp::new(Session::new(), Services::default());
-        app.ui.interface_language = Preference::Ukrainian;
-        app.ui.dialog = Some(dialog.into());
+fn dialogs_render_in_every_language_and_keep_their_source_ids() {
+    for language in translated() {
+        for (dialog, heading) in [
+            ("dsettings", "Drafting Settings"),
+            ("about", "About CADCraft"),
+            ("commands", "Command Reference"),
+            ("blocks", "Blocks"),
+            ("layers", "Layer Properties Manager"),
+            ("qselect", "Quick Select"),
+            ("parameters", "Parameters Manager"),
+            ("language", "Interface Language"),
+            ("hatch", "Hatch and Gradient"),
+            ("options:preferences", "User Preferences"),
+        ] {
+            let mut app = CadApp::new(Session::new(), Services::default());
+            app.ui.interface_language = Preference::parse(language.code).unwrap();
+            app.ui.dialog = Some(dialog.into());
+            let ctx = egui::Context::default();
+            app.logic(&ctx);
+            let text = render(&mut app, &ctx);
+            assert!(text.contains(tr(app.language(), heading)), "{}: {dialog}: {text}", language.code);
+            assert_eq!(app.ui.dialog.as_deref(), Some(dialog));
+        }
+    }
+}
+
+/// The letters of every catalog have glyphs in both UI families. Latin, Cyrillic and Greek come
+/// from egui's bundled fonts alone, as in the web build; the scripts they lack need a font that
+/// `install_fonts` finds, and are checked only where one is there.
+#[test]
+fn interface_fonts_cover_every_letter_in_each_catalog() {
+    for language in translated() {
+        let extra_font = ["ko", "zh", "ar"].contains(&language.code);
+        if extra_font && !crate::theme::can_show(language.code) {
+            continue;
+        }
         let ctx = egui::Context::default();
-        app.logic(&ctx);
-        let text = render(&mut app, &ctx);
-        assert!(text.contains(heading), "{dialog}: {text}");
-        assert_eq!(app.ui.dialog.as_deref(), Some(dialog));
-    }
-}
-
-#[test]
-fn default_fonts_cover_every_german_special_letter_in_the_catalog() {
-    let ctx = egui::Context::default();
-    let mut output = ctx.run_ui(Default::default(), |_| {});
-    output.textures_delta.clear();
-    let letters: BTreeSet<_> = include_str!("de.tsv").chars().filter(|c| ('\u{00c0}'..='\u{00ff}').contains(c)).collect();
-    ctx.fonts_mut(|view| {
-        for family in [egui::FontFamily::Proportional, egui::FontFamily::Monospace] {
-            let mut font = view.fonts.font(&family);
-            for c in &letters {
-                assert!(font.characters().contains_key(c), "missing {c} in {family:?}");
+        if extra_font {
+            crate::theme::install_fonts(&ctx, language.code);
+        }
+        let mut output = ctx.run_ui(Default::default(), |_| {});
+        output.textures_delta.clear();
+        let letters: BTreeSet<char> = language
+            .source
+            .lines()
+            .filter(|line| !line.starts_with('#'))
+            .filter_map(|line| line.split('\t').nth(2))
+            .flat_map(str::chars)
+            .filter(|c| !c.is_ascii() && c.is_alphabetic())
+            .collect();
+        let missing = ctx.fonts_mut(|view| {
+            let mut missing = Vec::new();
+            for family in [egui::FontFamily::Proportional, egui::FontFamily::Monospace] {
+                // In egui 0.36, has_glyph can report a false negative for glyphs in the same
+                // face as the replacement character. Check the family's actual character maps.
+                let mut font = view.fonts.font(&family);
+                for c in &letters {
+                    if !font.characters().contains_key(c) {
+                        missing.push(format!("{family:?}: {c} (U+{:04X})", u32::from(*c)));
+                    }
+                }
             }
-        }
-    });
-}
-
-#[test]
-fn default_fonts_cover_every_brazilian_portuguese_letter_in_the_catalog() {
-    let ctx = egui::Context::default();
-    let mut output = ctx.run_ui(Default::default(), |_| {});
-    output.textures_delta.clear();
-    let letters: BTreeSet<_> = include_str!("pt_br.tsv").chars().filter(|c| ('\u{00c0}'..='\u{00ff}').contains(c)).collect();
-    ctx.fonts_mut(|view| {
-        for family in [egui::FontFamily::Proportional, egui::FontFamily::Monospace] {
-            let mut font = view.fonts.font(&family);
-            for c in &letters {
-                assert!(font.characters().contains_key(c), "missing {c} in {family:?}");
-            }
-        }
-    });
-}
-
-#[test]
-fn default_fonts_cover_every_ukrainian_letter_in_the_catalog() {
-    let ctx = egui::Context::default();
-    // Use only egui's bundled fonts, exactly as the web build does (no system-font loader).
-    let mut output = ctx.run_ui(Default::default(), |_| {});
-    output.textures_delta.clear();
-    let letters: BTreeSet<_> = include_str!("uk.tsv").chars().filter(|c| ('\u{0400}'..='\u{04ff}').contains(c)).collect();
-    ctx.fonts_mut(|view| {
-        for family in [egui::FontFamily::Proportional, egui::FontFamily::Monospace] {
-            // In egui 0.36, has_glyph can report a false negative for glyphs in the same
-            // face as the replacement character. Check the family's actual character maps.
-            let mut font = view.fonts.font(&family);
-            for c in &letters {
-                assert!(font.characters().contains_key(c), "missing {c} in {family:?}");
-            }
-        }
-    });
-}
-
-#[test]
-fn czech_locales_preferences_and_plural_forms() {
-    for tag in ["cs", "cs-CZ", "cs_CZ.UTF-8", "CS-cz", " cs-CZ ", "cs_CZ@euro"] {
-        assert_eq!(locale_language(tag), Some("cs"), "{tag}");
+            missing
+        });
+        assert!(missing.is_empty(), "{}: missing glyphs: {}", language.code, missing.join(", "));
     }
-    for tag in ["cz", "csharp", "csomething"] {
-        assert_eq!(locale_language(tag), None, "{tag}");
-    }
-    assert_eq!(Preference::parse("cs"), Some(Preference::Czech));
-    assert_eq!(Preference::Czech.name(), "Čeština");
-    assert_eq!(Preference::Czech.resolve(&["en-US".into()]), "cs");
-    assert_eq!(Preference::Auto.resolve(&["pl-PL".into(), "cs-CZ".into(), "en-US".into()]), "cs");
-    let mut app = CadApp::new(Session::new(), Services::default());
-    app.ui.interface_language = Preference::Czech;
-    let mut restored = CadApp::new(Session::new(), Services::default());
-    restored.load_prefs(&app.prefs_json());
-    assert_eq!(restored.ui.interface_language, Preference::Czech);
-    with_language("cs", || {
-        for (n, form) in [(0, 2), (1, 0), (2, 1), (4, 1), (5, 2), (11, 2), (21, 2), (22, 2), (25, 2), (u64::MAX, 2)] {
-            assert_eq!(plural_cs(n), form, "{n}");
-            let contributor = ["přispěvatel", "přispěvatelé", "přispěvatelů"][form];
-            let commit = ["commit", "commity", "commitů"][form];
-            assert_eq!(count(n, "{n} contributor", "{n} contributors"), format!("{n} {contributor}"));
-            assert_eq!(count(n, "{n} commit", "{n} commits"), format!("{n} {commit}"));
-        }
-        assert_eq!(format("Current: {color}", &[("color", "{n} Open".into())]), "Aktuální: {n} Open");
-    });
-}
-
-#[test]
-fn czech_menu_headings_keep_object_labels_and_other_catalogs() {
-    with_language("cs", || {
-        assert_eq!(menu("View"), "Zobrazení");
-        assert_eq!(t("View"), "Pohled");
-        assert_eq!(menu("Dimension"), "Kótování");
-        assert_eq!(t("Dimension"), "Kóta");
-        assert_eq!(menu("Draw"), "Kreslení");
-        assert_eq!(menu("Modify"), "Modifikace");
-        assert_eq!(menu("Edit"), "Úpravy");
-        assert_eq!(menu("File"), "Soubor");
-    });
-    for language in ["en", "uk", "de", "es", "pt-BR", "unknown"] {
-        for source in crate::menus::MENUS {
-            assert_eq!(tr_menu(language, source), tr(language, source));
-        }
-    }
-}
-
-#[test]
-fn live_czech_switch_preserves_drawing_command_and_saved_choice() {
-    let mut app = CadApp::new(Session::new(), Services::default());
-    app.ui.in_window_menu = true;
-    app.session.state_mut().unwrap().title = "Open".into();
-    let ctx = egui::Context::default();
-    app.logic(&ctx);
-    assert!(render(&mut app, &ctx).contains("Properties"));
-    app.start("line");
-    let prompt = crate::control::cmdline_state(&app);
-    let commands = crate::control::all_commands(&app);
-    app.run("ui.language", json!({"lang":"cs"})).unwrap();
-    let text = render(&mut app, &ctx);
-    for label in ["Vlastnosti", "Soubor", "Zobrazení", "Kreslení", "Kótování", "Určete první bod"] {
-        assert!(text.contains(label), "missing {label}: {text}");
-    }
-    assert_eq!(app.language(), "cs");
-    assert_eq!(app.session.state().unwrap().title, "Open");
-    assert_eq!(crate::control::cmdline_state(&app), prompt);
-    assert_eq!(crate::control::all_commands(&app), commands);
-    assert_eq!(t("Properties"), "Properties");
-    app.run("ui.resetpalettes", json!({})).unwrap();
-    assert_eq!(app.language(), "cs");
-    app.run("ui.language", json!({"lang":"en"})).unwrap();
-    assert!(render(&mut app, &ctx).contains("Properties"));
-}
-
-#[test]
-fn czech_dialogs_render_with_stable_ids() {
-    for (dialog, heading) in [
-        ("dsettings", "Nastavení kreslení"),
-        ("about", "O aplikaci CADCraft"),
-        ("commands", "Přehled příkazů"),
-        ("blocks", "Bloky"),
-        ("layers", "Správce vlastností hladin"),
-        ("qselect", "Rychlý výběr"),
-        ("parameters", "Správce parametrů"),
-        ("language", "Čeština"),
-        ("options:preferences", "Uživatelské předvolby"),
-    ] {
-        let mut app = CadApp::new(Session::new(), Services::default());
-        app.ui.interface_language = Preference::Czech;
-        app.ui.dialog = Some(dialog.into());
-        let ctx = egui::Context::default();
-        app.logic(&ctx);
-        let text = render(&mut app, &ctx);
-        assert!(text.contains(heading), "{dialog}: {text}");
-        assert_eq!(app.ui.dialog.as_deref(), Some(dialog));
-    }
-}
-
-#[test]
-fn default_fonts_cover_czech_letters_and_typographic_quotes() {
-    let ctx = egui::Context::default();
-    let mut output = ctx.run_ui(Default::default(), |_| {});
-    output.textures_delta.clear();
-    let letters: BTreeSet<_> = "ÁČĎÉĚÍŇÓŘŠŤÚŮÝŽáčďéěíňóřšťúůýž„“".chars().collect();
-    ctx.fonts_mut(|view| {
-        for family in [egui::FontFamily::Proportional, egui::FontFamily::Monospace] {
-            let mut font = view.fonts.font(&family);
-            for c in &letters {
-                assert!(font.characters().contains_key(c), "missing {c} in {family:?}");
-            }
-        }
-    });
-}
-
-#[test]
-fn russian_and_french_plurals() {
-    with_language("ru", || {
-        for (n, word) in [(1, "участник"), (2, "участника"), (5, "участников"), (21, "участник"), (22, "участника"), (11, "участников")]
-        {
-            assert_eq!(count(n, "{n} contributor", "{n} contributors"), format!("{n} {word}"));
-        }
-    });
-    with_language("fr", || {
-        for (n, word) in [(0, "contributeur"), (1, "contributeur"), (2, "contributeurs"), (10, "contributeurs")] {
-            assert_eq!(count(n, "{n} contributor", "{n} contributors"), format!("{n} {word}"));
-        }
-    });
-}
-
-#[test]
-fn italian_locales_plurals_and_accents() {
-    for tag in ["it", "it-IT", "it_IT.UTF-8", "IT-ch", " it-CH ", "it_IT@euro"] {
-        assert_eq!(locale_language(tag), Some("it"), "{tag}");
-    }
-    assert_eq!(locale_language("italic"), None);
-    assert_eq!(Preference::parse("it"), Some(Preference::Italian));
-    assert_eq!(Preference::Auto.resolve(&["it-IT".into(), "en-US".into()]), "it");
-    assert_eq!(Preference::Italian.resolve(&["uk-UA".into()]), "it");
-    with_language("it", || {
-        for (n, word) in [(0, "collaboratori"), (1, "collaboratore"), (2, "collaboratori"), (21, "collaboratori")] {
-            assert_eq!(count(n, "{n} contributor", "{n} contributors"), format!("{n} {word}"));
-        }
-        assert_eq!(t("Draw"), "Disegna");
-        assert_eq!(tr_menu("it", "Modify"), "Edita");
-        assert_eq!(tr("it", "Modify"), "Modifica");
-        assert_eq!(tr_menu("it", "View"), "Visualizza");
-        assert_eq!(tr("it", "View"), "Vista");
-    });
-    // Italian accented letters (à è é ì ò ù and capitals) come from the bundled egui fonts.
-    let ctx = egui::Context::default();
-    let mut output = ctx.run_ui(Default::default(), |_| {});
-    output.textures_delta.clear();
-    let letters: BTreeSet<_> = include_str!("it.tsv").chars().filter(|c| ('\u{00c0}'..='\u{00ff}').contains(c)).collect();
-    assert!(letters.contains(&'à') && letters.contains(&'è'));
-    ctx.fonts_mut(|view| {
-        for family in [egui::FontFamily::Proportional, egui::FontFamily::Monospace] {
-            let mut font = view.fonts.font(&family);
-            for c in &letters {
-                assert!(font.characters().contains_key(c), "missing {c} in {family:?}");
-            }
-        }
-    });
 }
 
 /// Chinese shows only with a font for it: an installed CJK font, or one this build embedded from
@@ -631,163 +441,23 @@ fn chinese_needs_a_cjk_font() {
 }
 
 #[test]
-fn hatch_dialog_extents_label_says_extents_in_ukrainian() {
-    assert_eq!(tr("uk", "Default to boundary extents"), "Типово за габаритами контуру");
-}
-
-#[test]
-fn korean_representative_translations_remain_available() {
-    let ko = catalog("ko").unwrap();
-    // Fixed regression examples; new source strings remain reported, not required for Korean.
-    assert!(REPORTED.contains(&"ko"));
-    for (context, source, expected) in [
-        ("", "File", "파일"),
-        ("menu", "View", "보기"),
-        ("menu", "Draw", "그리기"),
-        ("menu", "Dimension", "치수"),
-        ("menu", "Modify", "수정"),
-        ("", "Options...", "옵션..."),
-        ("", "User Preferences", "사용자 기본 설정"),
-        ("", "Interface Language", "인터페이스 언어"),
-        ("", "Properties", "특성"),
-        ("", "Degree", "도 기호"),
-        ("", "Style: Standard", "스타일: Standard"),
-        ("", "WCS", "WCS"),
-        ("@plural", "{n} contributor", "기여자 {n}명"),
-        ("@plural", "{n} commit", "커밋 {n}개"),
-    ] {
-        assert_eq!(ko.get(&(context, source)).copied(), Some(expected), "{context}: {source}");
-    }
-    assert_eq!(tr("ko", "future untranslated label"), "future untranslated label");
-}
-
-#[test]
-fn korean_locale_saved_preference_and_single_count_form() {
-    for tag in ["ko", "ko-KR", "ko_KR.UTF-8", "KO-kr", " ko-KR ", "ko_KR@euro"] {
-        assert_eq!(locale_language(tag), Some("ko"), "{tag}");
-    }
-    for tag in ["kr", "korean", "kotlin"] {
-        assert_eq!(locale_language(tag), None, "{tag}");
-    }
-    assert_eq!(Preference::parse("ko"), Some(Preference::Korean));
-    assert_eq!(Preference::Korean.resolve(&["en-US".into()]), "ko");
-    assert_eq!(Preference::Auto.resolve(&["pl-PL".into(), "ko-KR".into(), "en-US".into()]), "ko");
+fn korean_without_a_hangul_font_stays_english_and_says_why() {
     let mut app = CadApp::new(Session::new(), Services::default());
-    app.system_languages = vec!["ko-KR".into()];
-    app.run("ui.language", json!({"lang": "ko"})).unwrap();
-    let mut restored = CadApp::new(Session::new(), Services::default());
-    restored.system_languages = vec!["en-US".into()];
-    restored.load_prefs(&app.prefs_json());
-    assert_eq!(restored.ui.interface_language, Preference::Korean);
-    assert_eq!(restored.language(), app.language());
-    with_language("ko", || {
-        for n in [0, 1, 2, 5, 11, 21, 101, u64::MAX] {
-            assert_eq!(plural_ko(n), 0);
-            assert_eq!(count(n, "{n} contributor", "{n} contributors"), format!("기여자 {n}명"));
-        }
-        assert_eq!(format("Current: {color}", &[("color", "{n} Open".into())]), "현재: {n} Open");
-    });
-}
-
-#[test]
-fn korean_live_switch_keeps_automation_and_drawing_and_falls_back_without_font() {
-    let mut app = CadApp::new(Session::new(), Services::default());
-    app.ui.in_window_menu = true;
-    app.session.state_mut().unwrap().title = "Open".into();
-    let ctx = egui::Context::default();
-    app.logic(&ctx);
-    assert!(render(&mut app, &ctx).contains("Properties"));
-    app.start("line");
-    let prompt = crate::control::cmdline_state(&app);
-    let commands = crate::control::all_commands(&app);
-    let result = app.run("ui.language", json!({"lang": "ko"})).unwrap();
-    let supported = crate::theme::can_show("ko");
-    assert_eq!(result["shown"], if supported { "ko" } else { "en" });
+    let r = app.run("ui.language", json!({"lang": "ko"})).unwrap();
+    let shown = crate::theme::can_show("ko");
+    assert_eq!(r["shown"], if shown { "ko" } else { "en" });
     assert_eq!(app.ui.interface_language, Preference::Korean);
-    app.logic(&ctx);
-    assert_eq!(app.fonts_language, Some(app.language()));
-    let text = render(&mut app, &ctx);
-    if supported {
-        for label in ["특성", "파일", "첫 번째 점 지정"] {
-            assert!(text.contains(label), "missing {label}: {text}");
-        }
-    } else {
-        assert!(text.contains("Properties"));
+    if !shown {
         assert!(app.status.as_ref().is_some_and(|(s, _)| s.contains("No font covers the Korean interface")));
         assert_eq!(Preference::Korean.name(), "Korean");
     }
-    assert_eq!(app.session.state().unwrap().title, "Open");
-    assert_eq!(crate::control::cmdline_state(&app), prompt);
-    assert_eq!(crate::control::all_commands(&app), commands);
-    assert_eq!(t("Properties"), "Properties");
-    assert!(app.run("ui.language", json!({"lang": "bad"})).is_err());
-    app.run("ui.resetpalettes", json!({})).unwrap();
-    assert_eq!(app.ui.interface_language, Preference::Korean);
-    // The general ui.set route uses the same saved preference and font installation.
-    let (request, _) = crate::ControlRequest::new("ui.set", json!({"interfaceLanguage": "zh"}));
-    let _ = crate::control::handle(&mut app, &ctx, &request);
-    assert_eq!(app.ui.interface_language, Preference::Chinese);
-    app.logic(&ctx);
-    assert_eq!(app.fonts_language, Some(if crate::theme::can_show("zh") { "zh" } else { "en" }));
-    render(&mut app, &ctx);
-    let (request, _) = crate::ControlRequest::new("ui.set", json!({"interfaceLanguage": "ko"}));
-    let _ = crate::control::handle(&mut app, &ctx, &request);
-    assert_eq!(app.ui.interface_language, Preference::Korean);
-    app.logic(&ctx);
-    assert_eq!(app.fonts_language, Some(app.language()));
-    let text = render(&mut app, &ctx);
-    assert!(text.contains(if supported { "특성" } else { "Properties" }));
-    let (request, _) = crate::ControlRequest::new("ui.set", json!({"interfaceLanguage": "en"}));
-    let _ = crate::control::handle(&mut app, &ctx, &request);
-    app.logic(&ctx);
-    assert_eq!(app.fonts_language, Some("en"));
-    assert_eq!(app.ui.interface_language, Preference::English);
-    assert!(render(&mut app, &ctx).contains("Properties"));
-    assert_eq!(crate::menus::tree(&app).first().unwrap().0, "File");
 }
 
 #[test]
-fn korean_dialogs_keep_source_ids() {
-    if !crate::theme::can_show("ko") {
-        return; // The fallback path is covered above; do not claim glyph rendering here.
-    }
-    for (dialog, source) in [
-        ("dsettings", "Drafting Settings"),
-        ("about", "About CADCraft"),
-        ("commands", "Command Reference"),
-        ("blocks", "Blocks"),
-        ("layers", "Layer Properties Manager"),
-        ("qselect", "Quick Select"),
-        ("parameters", "Parameters Manager"),
-        ("language", "Interface Language"),
-        ("options:preferences", "User Preferences"),
-    ] {
-        let mut app = CadApp::new(Session::new(), Services::default());
-        app.ui.interface_language = Preference::Korean;
-        app.ui.dialog = Some(dialog.into());
-        let ctx = egui::Context::default();
-        app.logic(&ctx);
-        let text = render(&mut app, &ctx);
-        assert!(text.contains(tr("ko", source)), "{dialog}: {text}");
-        if dialog == "language" {
-            assert!(text.contains("한국어"), "{dialog}: {text}");
-        }
-        assert_eq!(app.ui.dialog.as_deref(), Some(dialog));
-    }
-}
-
-#[test]
-fn korean_ui_fonts_cover_catalog_and_language_picker_in_both_families() {
+fn korean_ui_fonts_cover_the_language_picker_in_both_families() {
     if !crate::theme::can_show("ko") {
         return;
     }
-    let letters: BTreeSet<_> = include_str!("ko.tsv")
-        .lines()
-        .filter_map(|line| line.split('\t').nth(2))
-        .flat_map(str::chars)
-        .chain("한국어".chars())
-        .filter(|c| !c.is_ascii())
-        .collect();
     // The picker shows 한국어 in an English interface only when the CJK fonts loaded in every
     // language cover Hangul; the Korean interface itself always does, with a fallback font.
     let ctx = egui::Context::default();
@@ -801,374 +471,13 @@ fn korean_ui_fonts_cover_catalog_and_language_picker_in_both_families() {
         let mut missing = Vec::new();
         for family in [egui::FontFamily::Proportional, egui::FontFamily::Monospace] {
             let mut font = view.fonts.font(&family);
-            for c in &letters {
-                if !font.characters().contains_key(c) {
-                    missing.push(format!("{family:?}: {c} (U+{:04X})", u32::from(*c)));
+            for c in "한국어".chars() {
+                if !font.characters().contains_key(&c) {
+                    missing.push(format!("{family:?}: {c}"));
                 }
             }
         }
         missing
     });
-    assert!(missing.is_empty(), "missing Korean UI glyphs: {}", missing.join(", "));
-}
-
-#[test]
-fn swedish_locales_preferences_and_plural_forms() {
-    for tag in ["sv", "sv-SE", "sv_SE.UTF-8", "SV-se", " sv-SE ", "sv-FI"] {
-        assert_eq!(locale_language(tag), Some("sv"), "{tag}");
-    }
-    // `se` is Northern Sami and `swe` the three-letter code; neither picks Swedish.
-    for tag in ["se", "swe", "svenska"] {
-        assert_eq!(locale_language(tag), None, "{tag}");
-    }
-    assert_eq!(Preference::parse("sv"), Some(Preference::Swedish));
-    assert_eq!(Preference::Swedish.name(), "Svenska");
-    assert_eq!(Preference::Swedish.resolve(&["en-US".into()]), "sv");
-    assert_eq!(Preference::Auto.resolve(&["pl-PL".into(), "sv-SE".into(), "en-US".into()]), "sv");
-    let mut app = CadApp::new(Session::new(), Services::default());
-    app.ui.interface_language = Preference::Swedish;
-    let mut restored = CadApp::new(Session::new(), Services::default());
-    restored.load_prefs(&app.prefs_json());
-    assert_eq!(restored.ui.interface_language, Preference::Swedish);
-    with_language("sv", || {
-        for n in [0, 1, 2, 5, 21, u64::MAX] {
-            // `bidragsgivare` is the same in the singular and the plural; `commit` takes an -s.
-            assert_eq!(count(n, "{n} contributor", "{n} contributors"), format!("{n} bidragsgivare"));
-            let commit = if n == 1 { "commit" } else { "commits" };
-            assert_eq!(count(n, "{n} commit", "{n} commits"), format!("{n} {commit}"));
-        }
-        assert_eq!(format("Current: {color}", &[("color", "{n} Open".into())]), "Aktuell: {n} Open");
-    });
-}
-
-#[test]
-fn swedish_menu_headings_keep_object_labels() {
-    with_language("sv", || {
-        assert_eq!(menu("Dimension"), "Måttsättning");
-        assert_eq!(t("Dimension"), "Mått");
-        assert_eq!(menu("View"), "Visa");
-        assert_eq!(menu("Draw"), "Rita");
-        assert_eq!(menu("Modify"), "Ändra");
-        assert_eq!(menu("Edit"), "Redigera");
-        assert_eq!(menu("File"), "Arkiv");
-    });
-}
-
-#[test]
-fn live_swedish_switch_preserves_drawing_command_and_saved_choice() {
-    let mut app = CadApp::new(Session::new(), Services::default());
-    app.ui.in_window_menu = true;
-    app.session.state_mut().unwrap().title = "Open".into();
-    let ctx = egui::Context::default();
-    app.logic(&ctx);
-    assert!(render(&mut app, &ctx).contains("Properties"));
-    app.start("line");
-    let prompt = crate::control::cmdline_state(&app);
-    let commands = crate::control::all_commands(&app);
-    app.run("ui.language", json!({"lang":"sv"})).unwrap();
-    let text = render(&mut app, &ctx);
-    for label in ["Egenskaper", "Arkiv", "Visa", "Rita", "Måttsättning", "Ange första punkten"] {
-        assert!(text.contains(label), "missing {label}: {text}");
-    }
-    assert_eq!(app.language(), "sv");
-    assert_eq!(app.session.state().unwrap().title, "Open");
-    assert_eq!(crate::control::cmdline_state(&app), prompt);
-    assert_eq!(crate::control::all_commands(&app), commands);
-    app.run("ui.language", json!({"lang":"en"})).unwrap();
-    assert!(render(&mut app, &ctx).contains("Properties"));
-}
-
-#[test]
-fn swedish_dialogs_render_with_stable_ids() {
-    for (dialog, heading) in [
-        ("dsettings", "Ritinställningar"),
-        ("about", "Om CADCraft"),
-        ("blocks", "Block"),
-        ("layers", "Hantera lageregenskaper"),
-        ("qselect", "Snabbmarkering"),
-        ("parameters", "Hantera parametrar"),
-        ("language", "Svenska"),
-        ("options:preferences", "Användarinställningar"),
-    ] {
-        let mut app = CadApp::new(Session::new(), Services::default());
-        app.ui.interface_language = Preference::Swedish;
-        app.ui.dialog = Some(dialog.into());
-        let ctx = egui::Context::default();
-        app.logic(&ctx);
-        let text = render(&mut app, &ctx);
-        assert!(text.contains(heading), "{dialog}: {text}");
-        assert_eq!(app.ui.dialog.as_deref(), Some(dialog));
-    }
-}
-
-#[test]
-fn default_fonts_cover_swedish_letters_and_quotes() {
-    let ctx = egui::Context::default();
-    let mut output = ctx.run_ui(Default::default(), |_| {});
-    output.textures_delta.clear();
-    let letters: BTreeSet<_> = "ÅÄÖÉåäöé”–".chars().collect();
-    ctx.fonts_mut(|view| {
-        for family in [egui::FontFamily::Proportional, egui::FontFamily::Monospace] {
-            let mut font = view.fonts.font(&family);
-            for c in &letters {
-                assert!(font.characters().contains_key(c), "missing {c} in {family:?}");
-            }
-        }
-    });
-}
-
-#[test]
-fn hungarian_locales_preferences_and_plural_forms() {
-    for tag in ["hu", "hu-HU", "hu_HU.UTF-8", "HU-hu", " hu-HU "] {
-        assert_eq!(locale_language(tag), Some("hu"), "{tag}");
-    }
-    // `hun` is the three-letter code; neither it nor the endonym picks Hungarian.
-    for tag in ["hun", "magyar"] {
-        assert_eq!(locale_language(tag), None, "{tag}");
-    }
-    assert_eq!(Preference::parse("hu"), Some(Preference::Hungarian));
-    assert_eq!(Preference::Hungarian.name(), "Magyar");
-    assert_eq!(Preference::Hungarian.resolve(&["en-US".into()]), "hu");
-    assert_eq!(Preference::Auto.resolve(&["pl-PL".into(), "hu-HU".into(), "en-US".into()]), "hu");
-    let mut app = CadApp::new(Session::new(), Services::default());
-    app.ui.interface_language = Preference::Hungarian;
-    let mut restored = CadApp::new(Session::new(), Services::default());
-    restored.load_prefs(&app.prefs_json());
-    assert_eq!(restored.ui.interface_language, Preference::Hungarian);
-    with_language("hu", || {
-        for n in [0, 1, 2, 5, 21, u64::MAX] {
-            // A numeral takes the singular noun, so every count has the same form.
-            assert_eq!(count(n, "{n} contributor", "{n} contributors"), format!("{n} közreműködő"));
-            assert_eq!(count(n, "{n} commit", "{n} commits"), format!("{n} commit"));
-        }
-        assert_eq!(format("Current: {color}", &[("color", "{n} Open".into())]), "Aktuális: {n} Open");
-    });
-}
-
-#[test]
-fn hungarian_menu_headings_keep_object_labels() {
-    with_language("hu", || {
-        assert_eq!(menu("Dimension"), "Méretezés");
-        assert_eq!(t("Dimension"), "Méret");
-        assert_eq!(menu("View"), "Nézet");
-        assert_eq!(menu("Draw"), "Rajzolás");
-        assert_eq!(menu("Modify"), "Módosítás");
-        assert_eq!(menu("Edit"), "Szerkesztés");
-        assert_eq!(menu("File"), "Fájl");
-    });
-}
-
-#[test]
-fn live_hungarian_switch_preserves_drawing_command_and_saved_choice() {
-    let mut app = CadApp::new(Session::new(), Services::default());
-    app.ui.in_window_menu = true;
-    app.session.state_mut().unwrap().title = "Open".into();
-    let ctx = egui::Context::default();
-    app.logic(&ctx);
-    assert!(render(&mut app, &ctx).contains("Properties"));
-    app.start("line");
-    let prompt = crate::control::cmdline_state(&app);
-    let commands = crate::control::all_commands(&app);
-    app.run("ui.language", json!({"lang":"hu"})).unwrap();
-    let text = render(&mut app, &ctx);
-    for label in ["Tulajdonságok", "Fájl", "Nézet", "Rajzolás", "Méretezés", "Add meg az első pontot"] {
-        assert!(text.contains(label), "missing {label}: {text}");
-    }
-    assert_eq!(app.language(), "hu");
-    assert_eq!(app.session.state().unwrap().title, "Open");
-    assert_eq!(crate::control::cmdline_state(&app), prompt);
-    assert_eq!(crate::control::all_commands(&app), commands);
-    app.run("ui.language", json!({"lang":"en"})).unwrap();
-    assert!(render(&mut app, &ctx).contains("Properties"));
-}
-
-#[test]
-fn hungarian_dialogs_render_with_stable_ids() {
-    for (dialog, heading) in [
-        ("dsettings", "Rajzolási beállítások"),
-        ("about", "A CADCraft névjegye"),
-        ("blocks", "Blokk"),
-        ("layers", "Rétegtulajdonság-kezelő"),
-        ("qselect", "Gyorskijelölés"),
-        ("parameters", "Paraméterkezelő"),
-        ("language", "Magyar"),
-        ("options:preferences", "Felhasználói beállítások"),
-    ] {
-        let mut app = CadApp::new(Session::new(), Services::default());
-        app.ui.interface_language = Preference::Hungarian;
-        app.ui.dialog = Some(dialog.into());
-        let ctx = egui::Context::default();
-        app.logic(&ctx);
-        let text = render(&mut app, &ctx);
-        assert!(text.contains(heading), "{dialog}: {text}");
-        assert_eq!(app.ui.dialog.as_deref(), Some(dialog));
-    }
-}
-
-#[test]
-fn default_fonts_cover_hungarian_letters_and_quotes() {
-    let ctx = egui::Context::default();
-    let mut output = ctx.run_ui(Default::default(), |_| {});
-    output.textures_delta.clear();
-    // Ő ő Ű ű (double acute) are in Latin Extended-A, outside the ranges the other tests check.
-    let letters: BTreeSet<_> = "ÁÉÍÓÖŐÚÜŰáéíóöőúüű„”–…".chars().collect();
-    ctx.fonts_mut(|view| {
-        for family in [egui::FontFamily::Proportional, egui::FontFamily::Monospace] {
-            let mut font = view.fonts.font(&family);
-            for c in &letters {
-                assert!(font.characters().contains_key(c), "missing {c} in {family:?}");
-            }
-        }
-    });
-}
-
-#[test]
-fn turkish_locales_preferences_and_single_count_form() {
-    for tag in ["tr", "tr-TR", "tr_TR.UTF-8", "TR-tr", " tr-TR ", "tr-CY"] {
-        assert_eq!(locale_language(tag), Some("tr"), "{tag}");
-    }
-    for tag in ["tur", "türkçe"] {
-        assert_eq!(locale_language(tag), None, "{tag}");
-    }
-    assert_eq!(Preference::parse("tr"), Some(Preference::Turkish));
-    assert_eq!(Preference::Turkish.name(), "Türkçe");
-    assert_eq!(Preference::Turkish.resolve(&["en-US".into()]), "tr");
-    assert_eq!(Preference::Auto.resolve(&["pl-PL".into(), "tr-TR".into(), "en-US".into()]), "tr");
-    let mut app = CadApp::new(Session::new(), Services::default());
-    app.ui.interface_language = Preference::Turkish;
-    let mut restored = CadApp::new(Session::new(), Services::default());
-    restored.load_prefs(&app.prefs_json());
-    assert_eq!(restored.ui.interface_language, Preference::Turkish);
-    with_language("tr", || {
-        // A Turkish noun stays singular after a number, 1 included.
-        for n in [0, 1, 2, 5, 21, u64::MAX] {
-            assert_eq!(count(n, "{n} contributor", "{n} contributors"), format!("{n} katkıda bulunan"));
-            assert_eq!(count(n, "{n} commit", "{n} commits"), format!("{n} commit"));
-        }
-        assert_eq!(format("Current: {color}", &[("color", "{n} Open".into())]), "Geçerli: {n} Open");
-    });
-}
-
-#[test]
-fn turkish_menu_headings_keep_object_labels_and_prompt_keywords() {
-    with_language("tr", || {
-        assert_eq!(menu("Dimension"), "Ölçülendirme");
-        assert_eq!(t("Dimension"), "Ölçü");
-        assert_eq!(menu("View"), "Görünüm");
-        assert_eq!(menu("Draw"), "Çiz");
-        assert_eq!(menu("Modify"), "Değiştir");
-        assert_eq!(menu("Edit"), "Düzenle");
-        assert_eq!(menu("File"), "Dosya");
-        // Clickable keywords keep the spelling the engine accepts.
-        assert_eq!(t("Enter Top, Zero or Bottom."), "Top, Zero veya Bottom girin.");
-        assert_eq!(t("Specify first point on circle: _tan to"), "Daire üzerindeki ilk noktayı belirtin: _tan to");
-    });
-}
-
-#[test]
-fn live_turkish_switch_preserves_drawing_command_and_saved_choice() {
-    let mut app = CadApp::new(Session::new(), Services::default());
-    app.ui.in_window_menu = true;
-    app.session.state_mut().unwrap().title = "Open".into();
-    let ctx = egui::Context::default();
-    app.logic(&ctx);
-    assert!(render(&mut app, &ctx).contains("Properties"));
-    app.start("line");
-    let prompt = crate::control::cmdline_state(&app);
-    let commands = crate::control::all_commands(&app);
-    app.run("ui.language", json!({"lang":"tr"})).unwrap();
-    let text = render(&mut app, &ctx);
-    for label in ["Özellikler", "Dosya", "Görünüm", "Çiz", "Ölçülendirme", "İlk noktayı belirtin"] {
-        assert!(text.contains(label), "missing {label}: {text}");
-    }
-    assert_eq!(app.language(), "tr");
-    assert_eq!(app.session.state().unwrap().title, "Open");
-    assert_eq!(crate::control::cmdline_state(&app), prompt);
-    assert_eq!(crate::control::all_commands(&app), commands);
-    app.run("ui.language", json!({"lang":"en"})).unwrap();
-    assert!(render(&mut app, &ctx).contains("Properties"));
-}
-
-#[test]
-fn turkish_dialogs_render_with_stable_ids() {
-    for (dialog, heading) in [
-        ("dsettings", "Çizim Ayarları"),
-        ("about", "CADCraft Hakkında"),
-        ("blocks", "Bloklar"),
-        ("layers", "Katman Özellikleri Yöneticisi"),
-        ("qselect", "Hızlı Seçim"),
-        ("parameters", "Parametre Yöneticisi"),
-        ("language", "Türkçe"),
-        ("options:preferences", "Kullanıcı Tercihleri"),
-    ] {
-        let mut app = CadApp::new(Session::new(), Services::default());
-        app.ui.interface_language = Preference::Turkish;
-        app.ui.dialog = Some(dialog.into());
-        let ctx = egui::Context::default();
-        app.logic(&ctx);
-        let text = render(&mut app, &ctx);
-        assert!(text.contains(heading), "{dialog}: {text}");
-        assert_eq!(app.ui.dialog.as_deref(), Some(dialog));
-    }
-}
-
-#[test]
-fn default_fonts_cover_every_turkish_letter_in_the_catalog() {
-    let ctx = egui::Context::default();
-    let mut output = ctx.run_ui(Default::default(), |_| {});
-    output.textures_delta.clear();
-    let mut letters: BTreeSet<_> = "ÇĞİÖŞÜçğıöşü".chars().collect();
-    let translations = include_str!("tr.tsv").lines().filter(|l| !l.starts_with('#')).filter_map(|l| l.rsplit('\t').next());
-    letters.extend(translations.flat_map(str::chars).filter(|c| !c.is_ascii() && c.is_alphabetic()));
-    ctx.fonts_mut(|view| {
-        for family in [egui::FontFamily::Proportional, egui::FontFamily::Monospace] {
-            let mut font = view.fonts.font(&family);
-            for c in &letters {
-                assert!(font.characters().contains_key(c), "missing {c} in {family:?}");
-            }
-        }
-    });
-}
-
-#[test]
-fn greek_catalog_locale_preferences_and_contexts() {
-    assert_eq!(Preference::parse("el"), Some(Preference::Greek));
-    assert_eq!(Preference::Greek.code(), "el");
-    assert_eq!(Preference::Greek.name(), "Ελληνικά");
-    for locale in ["el", "el-GR", "el_GR.UTF-8", "EL-cy"] {
-        assert_eq!(locale_language(locale), Some("el"));
-    }
-    assert_eq!(locale_language("elvish"), None);
-    assert_eq!(Preference::Greek.resolve(&["en-US".into()]), "el");
-    let saved = serde_json::to_string(&Preference::Greek).unwrap();
-    assert_eq!(saved, "\"el\"");
-    assert_eq!(serde_json::from_str::<Preference>(&saved).unwrap(), Preference::Greek);
-    assert_eq!(tr("el", "Layer"), "Επίπεδο (Layer)");
-    assert_eq!(tr_menu("el", "Dimension"), "Διαστασιολόγηση");
-    assert_eq!(tr("el", "Dimension"), "Διαστασιολόγηση (Dimension)");
-    with_language("el", || {
-        assert_eq!(t("Open"), "Άνοιγμα");
-        assert_eq!(count(1, "{n} contributor", "{n} contributors"), "1 συνεισφέρων");
-        assert_eq!(count(0, "{n} contributor", "{n} contributors"), "0 συνεισφέροντες");
-        assert_eq!(count(2, "{n} contributor", "{n} contributors"), "2 συνεισφέροντες");
-        assert_eq!(count(21, "{n} contributor", "{n} contributors"), "21 συνεισφέροντες");
-    });
-    assert_eq!(t("Open"), "Open", "language must not leak outside a render scope");
-}
-
-#[test]
-fn default_fonts_cover_all_greek_letters_in_the_catalog() {
-    let ctx = egui::Context::default();
-    let mut output = ctx.run_ui(Default::default(), |_| {});
-    output.textures_delta.clear();
-    let letters: BTreeSet<_> =
-        include_str!("el.tsv").chars().filter(|c| ('\u{0370}'..='\u{03ff}').contains(c) || ('\u{1f00}'..='\u{1fff}').contains(c)).collect();
-    ctx.fonts_mut(|view| {
-        for family in [egui::FontFamily::Proportional, egui::FontFamily::Monospace] {
-            let mut font = view.fonts.font(&family);
-            for c in &letters {
-                assert!(font.characters().contains_key(c), "missing Greek glyph {c} in {family:?}");
-            }
-        }
-    });
+    assert!(missing.is_empty(), "missing Korean picker glyphs: {}", missing.join(", "));
 }
diff --git a/crates/ui-egui/src/options/mod.rs b/crates/ui-egui/src/options/mod.rs
index d2f805aa6..37ee2c404 100644
--- a/crates/ui-egui/src/options/mod.rs
+++ b/crates/ui-egui/src/options/mod.rs
@@ -391,20 +391,4 @@ mod tests {
             assert_eq!(parse_hex(bad), None, "{bad}");
         }
     }
-
-    #[test]
-    fn dialog_labels_have_ukrainian_translations() {
-        let sources = [include_str!("dialog.rs")];
-        let mut missing: Vec<String> = dialog::TABS.iter().filter(|(_, l)| crate::i18n::tr("uk", l) == *l).map(|(_, l)| l.to_string()).collect();
-        for source in sources {
-            for rest in source.split("crate::tl!(").skip(1) {
-                let Some(text) = rest.strip_prefix('"').and_then(|r| r.split('"').next()) else { continue };
-                // File format names read the same in every language.
-                if crate::i18n::tr("uk", text) == text && !["DXF", "DWG"].contains(&text) {
-                    missing.push(text.to_string());
-                }
-            }
-        }
-        assert!(missing.is_empty(), "missing translations: {missing:?}");
-    }
 }
diff --git a/crates/ui-egui/src/xrefs.rs b/crates/ui-egui/src/xrefs.rs
index 5828169d7..fb9cb9ef1 100644
--- a/crates/ui-egui/src/xrefs.rs
+++ b/crates/ui-egui/src/xrefs.rs
@@ -24,7 +24,13 @@ pub fn route(app: &mut CadApp, id: &str, params: &Value) -> Option<Result<Value,
             if let Err(e) = app.session.start("xattach") {
                 return Some(Err(e.to_string()));
             }
-            app.cmdline(&path);
+            // Submit the picked filename as literal text, not through the command line: a path is
+            // attacker-controlled (the file picker returns whatever the user selected), and
+            // `cmdline` interprets command syntax, so a name like `'closeall` would run an engine
+            // command instead of naming the file (CWE-74).
+            if let Err(e) = app.session.input(cadcraft_engine::Input::Text(path)) {
+                return Some(Err(e.to_string()));
+            }
             Some(Ok(Value::Null))
         }
         _ => None,
diff --git a/crates/ui-egui/tests/animation_effects.rs b/crates/ui-egui/tests/it/animation_effects.rs
similarity index 100%
rename from crates/ui-egui/tests/animation_effects.rs
rename to crates/ui-egui/tests/it/animation_effects.rs
diff --git a/crates/ui-egui/tests/chrome_geometry.rs b/crates/ui-egui/tests/it/chrome_geometry.rs
similarity index 100%
rename from crates/ui-egui/tests/chrome_geometry.rs
rename to crates/ui-egui/tests/it/chrome_geometry.rs
diff --git a/crates/ui-egui/tests/context_menu.rs b/crates/ui-egui/tests/it/context_menu.rs
similarity index 100%
rename from crates/ui-egui/tests/context_menu.rs
rename to crates/ui-egui/tests/it/context_menu.rs
diff --git a/crates/ui-egui/tests/context_menus.rs b/crates/ui-egui/tests/it/context_menus.rs
similarity index 87%
rename from crates/ui-egui/tests/context_menus.rs
rename to crates/ui-egui/tests/it/context_menus.rs
index 4957ad80f..3134b8d3c 100644
--- a/crates/ui-egui/tests/context_menus.rs
+++ b/crates/ui-egui/tests/it/context_menus.rs
@@ -169,37 +169,6 @@ fn a_selected_block_reference_offers_the_block_editor() {
     assert_eq!(app.session.state().unwrap().block_editor(), None);
 }
 
-#[test]
-fn every_menu_label_has_a_ukrainian_translation() {
-    let mut app = app();
-    app.cmdline("LINE 0,0 10,0");
-    app.cmdline("");
-    app.run("pline", json!({ "vertices": [[0, 0], [10, 0]] })).unwrap();
-    select_all(&mut app);
-    let mut all = flatten(&context_menu::entries(&app));
-    let line = app.session.doc().unwrap().model.handles()[0];
-    app.session.set_selection(app.session.doc().unwrap().model.handles().into_iter().filter(|h| *h != line).collect());
-    all.extend(flatten(&context_menu::entries(&app)));
-    all.extend(flatten(&context_menu::snap_entries(&app)));
-    type_line(&mut app, "LINE");
-    type_line(&mut app, "0,0");
-    all.extend(flatten(&context_menu::command_entries(&app).unwrap()));
-    let mut missing = Vec::new();
-    for (label, id, _) in &all {
-        let segments: Vec<&str> = label.split('/').collect();
-        // The item itself is user text when it types a value, or a command name (Recent Commands).
-        let user_text = (id.starts_with(context_menu::TYPE) && !id.contains('\'')) || segments.first() == Some(&"Recent Commands");
-        let n = segments.len() - usize::from(user_text);
-        for s in &segments[..n] {
-            // Point filters (.X) and "Repeat LINE" (a template) aren't catalog keys.
-            if !s.starts_with('.') && !s.starts_with("Repeat ") && cadcraft_ui_egui::i18n::tr("uk", s) == *s {
-                missing.push(s.to_string());
-            }
-        }
-    }
-    assert!(missing.is_empty(), "untranslated menu labels: {missing:?}");
-}
-
 /// The text painted in one frame at `time` (seconds).
 fn painted(app: &mut CadApp, ctx: &egui::Context, events: Vec<egui::Event>, time: f64) -> String {
     fn collect(shape: &egui::Shape, text: &mut String) {
diff --git a/crates/ui-egui/tests/control_cmdline.rs b/crates/ui-egui/tests/it/control_cmdline.rs
similarity index 98%
rename from crates/ui-egui/tests/control_cmdline.rs
rename to crates/ui-egui/tests/it/control_cmdline.rs
index 0c723cf15..34a3f8cbe 100644
--- a/crates/ui-egui/tests/control_cmdline.rs
+++ b/crates/ui-egui/tests/it/control_cmdline.rs
@@ -1,5 +1,5 @@
 //! The app's control channel answers `cmdline.input` and `app.open` with the same reply shape as
-//! the headless MCP backend (`cadcraft_mcp::Headless`, tested in `crates/mcp/tests/cmdline_parity.rs`).
+//! the headless MCP backend (`cadcraft_mcp::Headless`, tested in `crates/mcp/tests/it/cmdline_parity.rs`).
 
 use cadcraft_engine::Session;
 use cadcraft_ui_egui::control::{ControlRequest, Outcome, handle};
diff --git a/crates/ui-egui/tests/control_cmdline_key.rs b/crates/ui-egui/tests/it/control_cmdline_key.rs
similarity index 95%
rename from crates/ui-egui/tests/control_cmdline_key.rs
rename to crates/ui-egui/tests/it/control_cmdline_key.rs
index de02816d7..b3858ffa0 100644
--- a/crates/ui-egui/tests/control_cmdline_key.rs
+++ b/crates/ui-egui/tests/it/control_cmdline_key.rs
@@ -1,5 +1,5 @@
 //! The app's control channel answers `cmdline.key` like `cmdline.input` and like the headless MCP
-//! backend (`crates/mcp/tests/cmdline_key.rs`): a refused Enter is echoed and reported in `error`.
+//! backend (`crates/mcp/tests/it/cmdline_key.rs`): a refused Enter is echoed and reported in `error`.
 
 use cadcraft_engine::Session;
 use cadcraft_ui_egui::control::{ControlRequest, Outcome, handle};
diff --git a/crates/ui-egui/tests/control_methods.rs b/crates/ui-egui/tests/it/control_methods.rs
similarity index 97%
rename from crates/ui-egui/tests/control_methods.rs
rename to crates/ui-egui/tests/it/control_methods.rs
index 36495657f..741d49b86 100644
--- a/crates/ui-egui/tests/control_methods.rs
+++ b/crates/ui-egui/tests/it/control_methods.rs
@@ -22,7 +22,7 @@ fn app() -> CadApp {
 
 /// The method names in the first column of the doc's method table.
 fn documented() -> BTreeSet<String> {
-    let doc = include_str!("../../../docs/control-protocol.md");
+    let doc = include_str!("../../../../docs/control-protocol.md");
     let table = doc.lines().skip_while(|l| !l.starts_with("| Method |")).skip(2).take_while(|l| l.starts_with('|'));
     table.filter_map(|l| l.split('|').nth(1)).flat_map(|cell| cell.split('`').skip(1).step_by(2).map(str::to_string).collect::<Vec<_>>()).collect()
 }
diff --git a/crates/ui-egui/tests/dialog_dispatch.rs b/crates/ui-egui/tests/it/dialog_dispatch.rs
similarity index 100%
rename from crates/ui-egui/tests/dialog_dispatch.rs
rename to crates/ui-egui/tests/it/dialog_dispatch.rs
diff --git a/crates/ui-egui/tests/docking_workflows.rs b/crates/ui-egui/tests/it/docking_workflows.rs
similarity index 100%
rename from crates/ui-egui/tests/docking_workflows.rs
rename to crates/ui-egui/tests/it/docking_workflows.rs
diff --git a/crates/ui-egui/tests/drafting_polar_increment.rs b/crates/ui-egui/tests/it/drafting_polar_increment.rs
similarity index 100%
rename from crates/ui-egui/tests/drafting_polar_increment.rs
rename to crates/ui-egui/tests/it/drafting_polar_increment.rs
diff --git a/crates/ui-egui/tests/drafting_spacing.rs b/crates/ui-egui/tests/it/drafting_spacing.rs
similarity index 100%
rename from crates/ui-egui/tests/drafting_spacing.rs
rename to crates/ui-egui/tests/it/drafting_spacing.rs
diff --git a/crates/ui-egui/tests/file_tab_titles.rs b/crates/ui-egui/tests/it/file_tab_titles.rs
similarity index 100%
rename from crates/ui-egui/tests/file_tab_titles.rs
rename to crates/ui-egui/tests/it/file_tab_titles.rs
diff --git a/crates/ui-egui/tests/gpu_viewport_stencil.rs b/crates/ui-egui/tests/it/gpu_viewport_stencil.rs
similarity index 100%
rename from crates/ui-egui/tests/gpu_viewport_stencil.rs
rename to crates/ui-egui/tests/it/gpu_viewport_stencil.rs
diff --git a/crates/ui-egui/tests/hidden_command_line.rs b/crates/ui-egui/tests/it/hidden_command_line.rs
similarity index 100%
rename from crates/ui-egui/tests/hidden_command_line.rs
rename to crates/ui-egui/tests/it/hidden_command_line.rs
diff --git a/crates/ui-egui/tests/lisp_files.rs b/crates/ui-egui/tests/it/lisp_files.rs
similarity index 100%
rename from crates/ui-egui/tests/lisp_files.rs
rename to crates/ui-egui/tests/it/lisp_files.rs
diff --git a/crates/ui-egui/tests/it/main.rs b/crates/ui-egui/tests/it/main.rs
new file mode 100644
index 000000000..2e2451579
--- /dev/null
+++ b/crates/ui-egui/tests/it/main.rs
@@ -0,0 +1,34 @@
+mod animation_effects;
+mod chrome_geometry;
+mod context_menu;
+mod context_menus;
+mod control_cmdline;
+mod control_cmdline_key;
+mod control_methods;
+mod dialog_dispatch;
+mod docking_workflows;
+mod drafting_polar_increment;
+mod drafting_spacing;
+mod file_tab_titles;
+mod gpu_viewport_stencil;
+mod hidden_command_line;
+mod lisp_files;
+mod measure_distance_snapping;
+mod menubar_hover;
+mod mspace_viewport_view;
+mod options_dialog;
+mod parameters_rename;
+mod pickdrag;
+mod properties_units;
+mod rapid_clicks;
+mod selection_cycling;
+mod shared_controls;
+mod shortcut_menus;
+mod status_bar_toggles;
+mod style_dialogs;
+mod system_cursor;
+mod text_double_click;
+mod toolsets_gear;
+mod toolsets_parametric;
+mod viewport_double_click_selection;
+mod workspace_focus;
diff --git a/crates/ui-egui/tests/measure_distance_snapping.rs b/crates/ui-egui/tests/it/measure_distance_snapping.rs
similarity index 100%
rename from crates/ui-egui/tests/measure_distance_snapping.rs
rename to crates/ui-egui/tests/it/measure_distance_snapping.rs
diff --git a/crates/ui-egui/tests/menubar_hover.rs b/crates/ui-egui/tests/it/menubar_hover.rs
similarity index 100%
rename from crates/ui-egui/tests/menubar_hover.rs
rename to crates/ui-egui/tests/it/menubar_hover.rs
diff --git a/crates/ui-egui/tests/mspace_viewport_view.rs b/crates/ui-egui/tests/it/mspace_viewport_view.rs
similarity index 100%
rename from crates/ui-egui/tests/mspace_viewport_view.rs
rename to crates/ui-egui/tests/it/mspace_viewport_view.rs
diff --git a/crates/ui-egui/tests/options_dialog.rs b/crates/ui-egui/tests/it/options_dialog.rs
similarity index 100%
rename from crates/ui-egui/tests/options_dialog.rs
rename to crates/ui-egui/tests/it/options_dialog.rs
diff --git a/crates/ui-egui/tests/parameters_rename.rs b/crates/ui-egui/tests/it/parameters_rename.rs
similarity index 100%
rename from crates/ui-egui/tests/parameters_rename.rs
rename to crates/ui-egui/tests/it/parameters_rename.rs
diff --git a/crates/ui-egui/tests/pickdrag.rs b/crates/ui-egui/tests/it/pickdrag.rs
similarity index 100%
rename from crates/ui-egui/tests/pickdrag.rs
rename to crates/ui-egui/tests/it/pickdrag.rs
diff --git a/crates/ui-egui/tests/properties_units.rs b/crates/ui-egui/tests/it/properties_units.rs
similarity index 100%
rename from crates/ui-egui/tests/properties_units.rs
rename to crates/ui-egui/tests/it/properties_units.rs
diff --git a/crates/ui-egui/tests/rapid_clicks.rs b/crates/ui-egui/tests/it/rapid_clicks.rs
similarity index 100%
rename from crates/ui-egui/tests/rapid_clicks.rs
rename to crates/ui-egui/tests/it/rapid_clicks.rs
diff --git a/crates/ui-egui/tests/selection_cycling.rs b/crates/ui-egui/tests/it/selection_cycling.rs
similarity index 100%
rename from crates/ui-egui/tests/selection_cycling.rs
rename to crates/ui-egui/tests/it/selection_cycling.rs
diff --git a/crates/ui-egui/tests/shared_controls.rs b/crates/ui-egui/tests/it/shared_controls.rs
similarity index 100%
rename from crates/ui-egui/tests/shared_controls.rs
rename to crates/ui-egui/tests/it/shared_controls.rs
diff --git a/crates/ui-egui/tests/shortcut_menus.rs b/crates/ui-egui/tests/it/shortcut_menus.rs
similarity index 92%
rename from crates/ui-egui/tests/shortcut_menus.rs
rename to crates/ui-egui/tests/it/shortcut_menus.rs
index eb132b8c8..360fce521 100644
--- a/crates/ui-egui/tests/shortcut_menus.rs
+++ b/crates/ui-egui/tests/it/shortcut_menus.rs
@@ -136,7 +136,7 @@ fn layer_and_properties_palette_menus() {
 }
 
 #[test]
-fn every_label_has_a_ukrainian_translation_and_every_id_a_command() {
+fn every_id_is_a_command() {
     let mut app = app();
     app.cmdline("LINE 0,0 10,0");
     app.cmdline("");
@@ -146,16 +146,7 @@ fn every_label_has_a_ukrainian_translation_and_every_id_a_command() {
     all.extend(flatten(&sm::layout_tab_entries(&app, "Layout1")));
     all.extend(flatten(&sm::layer_entries(&app, "0")));
     all.extend(flatten(&sm::properties_entries(&app)));
-    let mut missing = Vec::new();
     for (label, id, _) in &all {
-        let segments: Vec<&str> = label.split('/').collect();
-        // Command names (Recent Commands) and line counts aren't translated.
-        let n = segments.len() - usize::from(segments.len() > 1);
-        for s in &segments[..n] {
-            if cadcraft_ui_egui::i18n::tr("uk", s) == *s {
-                missing.push(s.to_string());
-            }
-        }
         let command = id.strip_prefix("run:").and_then(|r| r.split_once(':')).map_or(id.as_str(), |(c, _)| c);
         let special = ["drawing:", "layout:", "cmdline:"].iter().any(|p| id.starts_with(p));
         assert!(
@@ -163,5 +154,4 @@ fn every_label_has_a_ukrainian_translation_and_every_id_a_command() {
             "{label}: {id} isn't a command"
         );
     }
-    assert!(missing.is_empty(), "untranslated menu labels: {missing:?}");
 }
diff --git a/crates/ui-egui/tests/status_bar_toggles.rs b/crates/ui-egui/tests/it/status_bar_toggles.rs
similarity index 100%
rename from crates/ui-egui/tests/status_bar_toggles.rs
rename to crates/ui-egui/tests/it/status_bar_toggles.rs
diff --git a/crates/ui-egui/tests/style_dialogs.rs b/crates/ui-egui/tests/it/style_dialogs.rs
similarity index 100%
rename from crates/ui-egui/tests/style_dialogs.rs
rename to crates/ui-egui/tests/it/style_dialogs.rs
diff --git a/crates/ui-egui/tests/system_cursor.rs b/crates/ui-egui/tests/it/system_cursor.rs
similarity index 100%
rename from crates/ui-egui/tests/system_cursor.rs
rename to crates/ui-egui/tests/it/system_cursor.rs
diff --git a/crates/ui-egui/tests/text_double_click.rs b/crates/ui-egui/tests/it/text_double_click.rs
similarity index 100%
rename from crates/ui-egui/tests/text_double_click.rs
rename to crates/ui-egui/tests/it/text_double_click.rs
diff --git a/crates/ui-egui/tests/toolsets_gear.rs b/crates/ui-egui/tests/it/toolsets_gear.rs
similarity index 100%
rename from crates/ui-egui/tests/toolsets_gear.rs
rename to crates/ui-egui/tests/it/toolsets_gear.rs
diff --git a/crates/ui-egui/tests/toolsets_parametric.rs b/crates/ui-egui/tests/it/toolsets_parametric.rs
similarity index 100%
rename from crates/ui-egui/tests/toolsets_parametric.rs
rename to crates/ui-egui/tests/it/toolsets_parametric.rs
diff --git a/crates/ui-egui/tests/viewport_double_click_selection.rs b/crates/ui-egui/tests/it/viewport_double_click_selection.rs
similarity index 100%
rename from crates/ui-egui/tests/viewport_double_click_selection.rs
rename to crates/ui-egui/tests/it/viewport_double_click_selection.rs
diff --git a/crates/ui-egui/tests/workspace_focus.rs b/crates/ui-egui/tests/it/workspace_focus.rs
similarity index 100%
rename from crates/ui-egui/tests/workspace_focus.rs
rename to crates/ui-egui/tests/it/workspace_focus.rs
diff --git a/docs/autolisp.md b/docs/autolisp.md
index e26702c2c..910fc2787 100644
--- a/docs/autolisp.md
+++ b/docs/autolisp.md
@@ -85,5 +85,5 @@ filters take radians too.
 ## Testing against the corpus
 
 The AutoLISP conformance corpus (#648) lives in its own repository. Point `CADCRAFT_LISP_CORPUS`
-at it and run `cargo test -p cadcraft-engine --test lisp_corpus`; without the variable the test
+at it and run `cargo test -p cadcraft-engine --test it lisp_corpus::`; without the variable the test
 says it was skipped.
diff --git a/docs/control-protocol.md b/docs/control-protocol.md
index 56cf4d990..b1e91a52c 100644
--- a/docs/control-protocol.md
+++ b/docs/control-protocol.md
@@ -5,10 +5,18 @@ Start the desktop app with `--control PORT` (or `CADCRAFT_CONTROL_PORT=PORT`). I
 `--control` wins over the variable; a bare `--control` keeps the variable's port.
 
 ```json
-{"id": 1, "method": "cmdline.input", "params": {"text": "circle 0,0 5"}}
+{"id": 1, "method": "cmdline.input", "params": {"text": "circle 0,0 5"}, "token": "<session token>"}
 {"id": 1, "ok": true, "result": {"prompt": "Command:", "output": ["Command: CIRCLE"], ...}}
 ```
 
+Every request must carry the session `token`. Because loopback TCP cannot tell local operating
+system users apart, the app writes an unguessable per-session token to an owner-only file when the
+control server starts, and refuses (`unauthorized`) any request without a matching token. The file
+is `cadcraft-control-<port>.token` in the per-user runtime directory (`$XDG_RUNTIME_DIR`, else
+`~/.cache`; `%LOCALAPPDATA%` on Windows); its path is logged at startup. A client reads the token
+from that file — which requires the desktop user's own filesystem access — and includes it on each
+line. The MCP bridge (`cadcraft-cli mcp --connect`) does this automatically.
+
 Errors come back as `{"id": …, "ok": false, "error": "message"}`. An unknown method's error points
 to `control.methods`, which lists the methods the server answers.
 
diff --git a/docs/localization.md b/docs/localization.md
index d3c6cc4e1..b7f21af3a 100644
--- a/docs/localization.md
+++ b/docs/localization.md
@@ -30,8 +30,8 @@ selection. Resetting palettes keeps the language choice.
 The catalogs cover command and menu labels, tool groups and tooltips, the Start page,
 file and model-space tabs, status controls, object snaps, drafting prompts, property labels,
 dialogs, and the About window's controls. The command reference can be searched by English
-command ID, English label, or translated label. Ukrainian has enforced coverage;
-missing entries in the other catalogs are reported by tests and fall back to English.
+command ID, English label, or translated label. A missing entry falls back to English and
+never fails a build; `cargo xtask i18n` (a step of `cargo xtask ci`) lists each language's.
 
 Czech has 1,202 catalog rows, covering the reference catalog and every marked UI
 literal, including Options. Four `menu` entries distinguish menu headings from object/command
@@ -139,14 +139,14 @@ The implementation follows the display-time catalog pattern used by
 - Windows retain explicit IDs based on their English source, and tool groups retain their
   source names as keys, so switching languages preserves their state.
 - Add a translation attribution row in `ATTRIBUTION.md`, update the language lists, and add
-  locale, plural, font-glyph and live-switch tests. Add the catalog to `REPORTED` in
-  `i18n/tests.rs`: only Ukrainian, the reference translation, is in `REQUIRED`, so adding a
-  command needs a row in one language, not in all of them.
+  the language's locale tags and plural rule. The rendering, font-glyph and live-switch tests
+  run for every catalog; no test checks one language's wording, and adding a command needs
+  only its English label.
 - Catalogs are embedded and parsed once. Missing or malformed rows cannot crash the app;
   tests reject invalid rows, duplicate keys, changed placeholders, and mismatched ellipses.
-- `cargo test -p cadcraft-ui-egui i18n` checks menu/command/tool/snap coverage, every marked
-  UI literal, locale resolution, preferences, integer plurals, bundled glyphs and actual
-  egui renders with language switching. `cargo xtask assets` checks asset attribution;
+- `cargo test -p cadcraft-ui-egui i18n` checks the catalogs, locale resolution, preferences,
+  integer plurals, bundled glyphs and actual egui renders with language switching.
+  `cargo xtask i18n` prints the strings each language shows in English. `cargo xtask assets` checks asset attribution;
   `cargo xtask ci` runs the workspace quality gates.
 
 Translations are original work under `MIT OR Apache-2.0`, written from the meaning of
diff --git a/packaging/env.sh b/packaging/env.sh
index e70334801..ab01ce4c5 100644
--- a/packaging/env.sh
+++ b/packaging/env.sh
@@ -19,10 +19,11 @@ workspace_version() {
     /^\[/ { in_pkg = ($0 == "[workspace.package]") ; next }
     in_pkg && $1 == "version" { gsub(/[" ]/, "", $3); print $3; exit }
   ' "$ROOT/Cargo.toml"
+  return
 }
 
 VERSION="${CADCRAFT_VERSION:-$(workspace_version)}"
-if [ -z "$VERSION" ]; then
+if [[ -z "$VERSION" ]]; then
   echo "error: could not read [workspace.package] version from $ROOT/Cargo.toml" >&2
   exit 1
 fi
@@ -32,7 +33,7 @@ DIST="${DIST:-$ROOT/dist/release}"
 mkdir -p "$DIST"
 export DIST
 
-if [ -z "${CADCRAFT_BUILD_SHA:-}" ]; then
+if [[ -z "${CADCRAFT_BUILD_SHA:-}" ]]; then
   CADCRAFT_BUILD_SHA="$(git -C "$ROOT" rev-parse HEAD 2>/dev/null || true)"
 fi
 export CADCRAFT_BUILD_SHA
@@ -41,29 +42,33 @@ export CARGO_TARGET_DIR="${CARGO_TARGET_DIR:-$ROOT/target}"
 
 # Emit a GitHub Actions warning (plain stderr outside Actions).
 warn() {
-  if [ -n "${GITHUB_ACTIONS:-}" ]; then echo "::warning::$*"; else echo "warning: $*" >&2; fi
+  if [[ -n "${GITHUB_ACTIONS:-}" ]]; then echo "::warning::$*"; else echo "warning: $*" >&2; fi
+  return
 }
 
 # Copy licence and readme files that exist into a package directory.
 copy_docs() {
   local dest="$1" f
   for f in README.md LICENSE LICENSE-MIT LICENSE-APACHE COPYRIGHT; do
-    if [ -f "$ROOT/$f" ]; then cp "$ROOT/$f" "$dest/"; fi
+    if [[ -f "$ROOT/$f" ]]; then cp "$ROOT/$f" "$dest/"; fi
   done
   copy_font_licences "$dest"
+  return
 }
 
 # Builds made with craft-fonts (CRAFT_FONTS_DIR, set by the release workflow) embed its fonts, so
 # the package carries their licences as OFL-<family-dir>.txt. Nothing without CRAFT_FONTS_DIR.
 copy_font_licences() {
   local dest="$1" f
-  [ -n "${CRAFT_FONTS_DIR:-}" ] || return 0
+  [[ -n "${CRAFT_FONTS_DIR:-}" ]] || return 0
   for f in "$CRAFT_FONTS_DIR"/fonts/*/OFL.txt; do
-    if [ -f "$f" ]; then cp "$f" "$dest/OFL-$(basename "$(dirname "$f")").txt"; fi
+    if [[ -f "$f" ]]; then cp "$f" "$dest/OFL-$(basename "$(dirname "$f")").txt"; fi
   done
 }
 
 # Portable SHA-256 of a file (prints just the hash).
 sha256() {
-  if command -v sha256sum >/dev/null; then sha256sum "$1" | cut -d' ' -f1; else shasum -a 256 "$1" | cut -d' ' -f1; fi
+  local file="$1"
+  if command -v sha256sum >/dev/null; then sha256sum "$file" | cut -d' ' -f1; else shasum -a 256 "$file" | cut -d' ' -f1; fi
+  return
 }
diff --git a/packaging/icons.sh b/packaging/icons.sh
index 3cb8ea733..d19aa44d4 100755
--- a/packaging/icons.sh
+++ b/packaging/icons.sh
@@ -12,7 +12,10 @@ TMP="$(mktemp -d)"
 trap 'rm -rf "$TMP"' EXIT
 command -v sips >/dev/null || { echo "error: sips not found (macOS only)" >&2; exit 1; }
 
-resize() { sips -s format png -z "$2" "$2" "$1" --out "$3" >/dev/null; }
+resize() {
+  local src="$1" size="$2" out="$3"
+  sips -s format png -z "$size" "$size" "$src" --out "$out" >/dev/null
+}
 
 for s in 16 24 32 48 64 128 256 512; do
   mkdir -p "$DIR/hicolor/${s}x${s}/apps"
diff --git a/packaging/linux/flatpak-bundle.sh b/packaging/linux/flatpak-bundle.sh
index 9baccf92c..5154fe076 100755
--- a/packaging/linux/flatpak-bundle.sh
+++ b/packaging/linux/flatpak-bundle.sh
@@ -21,7 +21,7 @@ FLATHUB=https://dl.flathub.org/repo/flathub.flatpakrepo
 
 TEST=1
 TARBALL=""
-while [ $# -gt 0 ]; do
+while [[ $# -gt 0 ]]; do
   case "$1" in
     --no-test) TEST=0; shift ;;
     -h | --help) sed -n '2,14p' "$0"; exit 0 ;;
@@ -38,7 +38,7 @@ case "$ARCH" in
 esac
 BASENAME="cadcraft-$VERSION-linux-$ARCH"
 TARBALL="${TARBALL:-$DIST/$BASENAME.tar.gz}"
-[ -f "$TARBALL" ] || { echo "error: $TARBALL not found (run packaging/linux/package.sh --formats tar first)" >&2; exit 1; }
+[[ -f "$TARBALL" ]] || { echo "error: $TARBALL not found (run packaging/linux/package.sh --formats tar first)" >&2; exit 1; }
 for tool in flatpak flatpak-builder; do
   command -v "$tool" >/dev/null || { echo "error: $tool not found (apt install flatpak flatpak-builder librsvg2-common)" >&2; exit 1; }
 done
@@ -49,7 +49,7 @@ WORK="$CARGO_TARGET_DIR/flatpak-bundle"
 rm -rf "$WORK"
 mkdir -p "$WORK/stage"
 tar -xzf "$TARBALL" -C "$WORK/stage" --strip-components=1
-[ -x "$WORK/stage/bin/cadcraft" ] || { echo "error: $TARBALL has no bin/cadcraft" >&2; exit 1; }
+[[ -x "$WORK/stage/bin/cadcraft" ]] || { echo "error: $TARBALL has no bin/cadcraft" >&2; exit 1; }
 cp "$HERE/flatpak/$APP_ID.bundle.yml" "$WORK/$APP_ID.yml"
 
 flatpak remote-add --user --if-not-exists flathub "$FLATHUB"
@@ -62,7 +62,7 @@ OUT="$DIST/$BASENAME.flatpak"
 flatpak build-bundle --runtime-repo="$FLATHUB" "$WORK/repo" "$OUT" "$APP_ID" stable
 echo "wrote $OUT"
 
-if [ "$TEST" = 1 ]; then
+if [[ "$TEST" = 1 ]]; then
   flatpak install --user -y --noninteractive --reinstall "$OUT"
   flatpak info --user "$APP_ID"
   flatpak run --command=cadcraft-cli "$APP_ID" --version
diff --git a/packaging/linux/package.sh b/packaging/linux/package.sh
index c11fd3b3f..36b69cecb 100755
--- a/packaging/linux/package.sh
+++ b/packaging/linux/package.sh
@@ -21,7 +21,7 @@ APP_ID=ai.storyteller.cadcraft
 
 SKIP_BUILD=0
 FORMATS="appimage deb rpm tar"
-while [ $# -gt 0 ]; do
+while [[ $# -gt 0 ]]; do
   case "$1" in
     --skip-build) SKIP_BUILD=1; shift ;;
     --formats) FORMATS="$2"; shift 2 ;;
@@ -44,8 +44,8 @@ BASENAME="cadcraft-$VERSION-linux-$ARCH"
 
 echo "==> CADCraft $VERSION for Linux $ARCH ($FORMATS)"
 
-if [ "$SKIP_BUILD" = 0 ]; then
-  if [ -n "${CROSS_TARGET:-}" ]; then
+if [[ "$SKIP_BUILD" = 0 ]]; then
+  if [[ -n "${CROSS_TARGET:-}" ]]; then
     (cd "$ROOT" && cargo build --release --locked -p cadcraft -p cadcraft-cli --target "$CROSS_TARGET")
   else
     (cd "$ROOT" && cargo build --release --locked -p cadcraft -p cadcraft-cli)
@@ -77,7 +77,7 @@ if command -v appstreamcli >/dev/null; then
   appstreamcli validate --no-net --explain "$STAGE/usr/share/metainfo/$APP_ID.metainfo.xml"
 fi
 
-has() { case " $FORMATS " in *" $1 "*) return 0 ;; *) return 1 ;; esac; }
+has() { local format="$1"; case " $FORMATS " in *" $format "*) return 0 ;; *) return 1 ;; esac; }
 
 # ---- .tar.gz ------------------------------------------------------------------------------------
 if has tar; then
@@ -110,10 +110,10 @@ if has appimage; then
   ln -s "$APP_ID.png" "$APPDIR/.DirIcon"
 
   TOOL="${APPIMAGETOOL:-$(command -v appimagetool || true)}"
-  if [ -z "$TOOL" ]; then
+  if [[ -z "$TOOL" ]]; then
     TOOL="$CARGO_TARGET_DIR/appimagetool-$ARCH.AppImage"
-    if [ ! -x "$TOOL" ]; then
-      curl -fsSL -o "$TOOL" "https://github.com/AppImage/appimagetool/releases/download/continuous/appimagetool-$ARCH.AppImage"
+    if [[ ! -x "$TOOL" ]]; then
+      curl --proto '=https' -fsSL -o "$TOOL" "https://github.com/AppImage/appimagetool/releases/download/continuous/appimagetool-$ARCH.AppImage"
       chmod +x "$TOOL"
     fi
   fi
@@ -135,16 +135,16 @@ if has appimage; then
   # package) appimagetool also writes the .zsync, into its working directory, hence the cd.
   (cd "$DIST" && ARCH="$ARCH" APPIMAGE_EXTRACT_AND_RUN=1 "$TOOL" --no-appstream -u "$UPDATE_INFO" "$APPDIR" "$OUT")
   echo "wrote $OUT"
-  if [ -s "$OUT.zsync" ]; then
+  if [[ -s "$OUT.zsync" ]]; then
     echo "wrote $OUT.zsync"
   else
     warn "zsyncmake not found, so $OUT.zsync was not written; AppImage delta updates need it"
   fi
 fi
 
-if [ -z "${CROSS_TARGET:-}" ]; then
+if [[ -z "${CROSS_TARGET:-}" ]]; then
   "$STAGE/usr/bin/cadcraft-cli" --version
-elif [ -n "${EMULATOR:-}" ]; then
+elif [[ -n "${EMULATOR:-}" ]]; then
   "$EMULATOR" "$STAGE/usr/bin/cadcraft-cli" --version
 fi
 echo "==> done"
diff --git a/packaging/macos/import-cert.sh b/packaging/macos/import-cert.sh
index e36c0c1b8..b1fa71435 100755
--- a/packaging/macos/import-cert.sh
+++ b/packaging/macos/import-cert.sh
@@ -12,17 +12,22 @@ umask 077
 # shellcheck source=../env.sh
 . "$(dirname "${BASH_SOURCE[0]}")/../env.sh"
 
-if [ -z "${APPLE_CERTIFICATE:-}" ]; then
+if [[ -z "${APPLE_CERTIFICATE:-}" ]]; then
   warn "APPLE_CERTIFICATE is not set: macOS builds will be ad-hoc signed and not notarized"
   exit 0
 fi
 
 TMP="${RUNNER_TEMP:-${TMPDIR:-/tmp}}"
+# Create a private per-run directory (mode 0700 via the umask above) so the decoded signing
+# container cannot be read by, or pre-created by, another local user in a shared temp directory.
+CERT_DIR="$(mktemp -d "$TMP/cadcraft-signing.XXXXXXXX")"
 KEYCHAIN="$TMP/cadcraft-signing.keychain-db"
-CERT="$TMP/cadcraft-signing.p12"
+CERT="$CERT_DIR/cadcraft-signing.p12"
 KC_PASS="${KEYCHAIN_PASSWORD:-$(openssl rand -hex 24)}"
 
-trap 'rm -f "$CERT"' EXIT
+trap 'rm -f "$CERT"; rm -rf "$CERT_DIR"' EXIT
+# Create the certificate file privately before writing, refusing to follow a pre-existing entry.
+( set -C; : >"$CERT" )
 printf '%s' "$APPLE_CERTIFICATE" | base64 --decode >"$CERT"
 security create-keychain -p "$KC_PASS" "$KEYCHAIN"
 security set-keychain-settings -lut 21600 "$KEYCHAIN"
@@ -36,13 +41,13 @@ security set-key-partition-list -S apple-tool:,apple:,codesign: -s -k "$KC_PASS"
 security list-keychains -d user -s "$KEYCHAIN" $(security list-keychains -d user | tr -d '"')
 
 IDENTITY="$(security find-identity -v -p codesigning "$KEYCHAIN" | awk '/Developer ID Application/ { print $2; exit }')"
-if [ -z "$IDENTITY" ]; then
+if [[ -z "$IDENTITY" ]]; then
   security find-identity -v -p codesigning "$KEYCHAIN" >&2
   echo "error: no 'Developer ID Application' identity in APPLE_CERTIFICATE" >&2
   exit 1
 fi
 echo "Imported signing identity $IDENTITY"
-if [ -n "${GITHUB_ENV:-}" ]; then
+if [[ -n "${GITHUB_ENV:-}" ]]; then
   { echo "MACOS_SIGN_IDENTITY=$IDENTITY"; echo "MACOS_KEYCHAIN=$KEYCHAIN"; } >>"$GITHUB_ENV"
 else
   echo "MACOS_SIGN_IDENTITY=$IDENTITY"
diff --git a/packaging/macos/package.sh b/packaging/macos/package.sh
index 203dc20dc..fd626fbf4 100755
--- a/packaging/macos/package.sh
+++ b/packaging/macos/package.sh
@@ -19,7 +19,7 @@ HERE="$ROOT/packaging/macos"
 
 ARCH=universal
 SKIP_BUILD=0
-while [ $# -gt 0 ]; do
+while [[ $# -gt 0 ]]; do
   case "$1" in
     --arch) ARCH="$2"; shift 2 ;;
     --skip-build) SKIP_BUILD=1; shift ;;
@@ -44,9 +44,9 @@ DMG="$DIST/cadcraft-$VERSION-macos-$ARCH.dmg"
 CLI_ZIP="$DIST/cadcraft-cli-$VERSION-macos-$ARCH.zip"
 
 NOTARIZE=0
-if [ "$IDENTITY" = "-" ]; then
+if [[ "$IDENTITY" = "-" ]]; then
   warn "macOS: ad-hoc signing (no MACOS_SIGN_IDENTITY); artifacts are not notarized"
-elif [ -n "${APPLE_ID:-}" ] && [ -n "${APPLE_PASSWORD:-}" ] && [ -n "${APPLE_TEAM_ID:-}" ]; then
+elif [[ -n "${APPLE_ID:-}" ]] && [[ -n "${APPLE_PASSWORD:-}" ]] && [[ -n "${APPLE_TEAM_ID:-}" ]]; then
   NOTARIZE=1
 else
   warn "macOS: APPLE_ID / APPLE_PASSWORD / APPLE_TEAM_ID incomplete; signed but not notarized"
@@ -55,7 +55,7 @@ fi
 echo "==> CADCraft $VERSION for macOS ($ARCH), identity: $IDENTITY, notarize: $NOTARIZE"
 
 # ---- build -------------------------------------------------------------------------------------
-if [ "$SKIP_BUILD" = 0 ]; then
+if [[ "$SKIP_BUILD" = 0 ]]; then
   args=()
   for t in "${TARGETS[@]}"; do args+=(--target "$t"); done
   (cd "$ROOT" && cargo build --release --locked -p cadcraft -p cadcraft-cli "${args[@]}")
@@ -74,9 +74,9 @@ done
 sign() {
   # Hardened runtime + secure timestamp for a real identity; ad-hoc can't be timestamped.
   local ts=(--timestamp)
-  [ "$IDENTITY" = "-" ] && ts=(--timestamp=none)
+  [[ "$IDENTITY" = "-" ]] && ts=(--timestamp=none)
   local kc=()
-  [ -n "${MACOS_KEYCHAIN:-}" ] && kc=(--keychain "$MACOS_KEYCHAIN")
+  [[ -n "${MACOS_KEYCHAIN:-}" ]] && kc=(--keychain "$MACOS_KEYCHAIN")
   codesign --force --sign "$IDENTITY" ${kc[@]+"${kc[@]}"} "${ts[@]}" "$@"
 }
 
@@ -88,8 +88,8 @@ notarize() {
   echo "$out"
   id="$(printf '%s' "$out" | plutil -extract id raw -o - - 2>/dev/null || true)"
   status="$(printf '%s' "$out" | plutil -extract status raw -o - - 2>/dev/null || true)"
-  if [ "$status" != "Accepted" ]; then
-    if [ -n "$id" ]; then
+  if [[ "$status" != "Accepted" ]]; then
+    if [[ -n "$id" ]]; then
       xcrun notarytool log "$id" --apple-id "$APPLE_ID" --password "$APPLE_PASSWORD" --team-id "$APPLE_TEAM_ID" || true
     fi
     echo "error: notarization of $(basename "$file") failed (status: ${status:-unknown})" >&2
@@ -117,7 +117,7 @@ sign --options runtime --entitlements "$HERE/entitlements.plist" "$APP/Contents/
 sign --options runtime --entitlements "$HERE/entitlements.plist" "$APP"
 codesign --verify --strict --deep --verbose=2 "$APP"
 
-if [ "$NOTARIZE" = 1 ]; then
+if [[ "$NOTARIZE" = 1 ]]; then
   ditto -c -k --keepParent "$APP" "$WORK/CADCraft-notarize.zip"
   notarize "$WORK/CADCraft-notarize.zip"
   xcrun stapler staple "$APP"
@@ -144,7 +144,7 @@ hdiutil convert "$WORK/raw.dmg" -format UDZO -imagekey zlib-level=9 -o "$DMG"
 rm -f "$WORK/raw.dmg"
 sign "$DMG"
 codesign --verify --strict --verbose=2 "$DMG"
-if [ "$NOTARIZE" = 1 ]; then
+if [[ "$NOTARIZE" = 1 ]]; then
   notarize "$DMG"
   xcrun stapler staple "$DMG"
   xcrun stapler validate "$DMG"
@@ -162,7 +162,7 @@ codesign --verify --strict --verbose=2 "$CLI_DIR/cadcraft-cli"
 rm -f "$CLI_ZIP"
 ditto -c -k --keepParent "$CLI_DIR" "$CLI_ZIP"
 # A bare Mach-O can't carry a stapled ticket; Gatekeeper looks the notarization up online.
-if [ "$NOTARIZE" = 1 ]; then notarize "$CLI_ZIP"; fi
+if [[ "$NOTARIZE" = 1 ]]; then notarize "$CLI_ZIP"; fi
 
 "$WORK/bin/cadcraft-cli" --version
 echo "==> done"
diff --git a/packaging/web/package.sh b/packaging/web/package.sh
index 7caa88ed0..6091bf5ee 100755
--- a/packaging/web/package.sh
+++ b/packaging/web/package.sh
@@ -11,13 +11,13 @@ set -euo pipefail
 . "$(dirname "${BASH_SOURCE[0]}")/../env.sh"
 HERE="$ROOT/packaging/web"
 
-if [ "${1:-}" != "--skip-build" ]; then
+if [[ "${1:-}" != "--skip-build" ]]; then
   command -v trunk >/dev/null || { echo "error: trunk not found (cargo install trunk --locked)" >&2; exit 1; }
   (cd "$ROOT/apps/cadcraft-web" && trunk build --release)
 fi
 
 SITE="$ROOT/dist/web"
-[ -f "$SITE/index.html" ] || { echo "error: $SITE/index.html missing; run without --skip-build" >&2; exit 1; }
+[[ -f "$SITE/index.html" ]] || { echo "error: $SITE/index.html missing; run without --skip-build" >&2; exit 1; }
 # Paths must be relative so the site works under any prefix (public_url = "./" in Trunk.toml).
 if grep -Eq '(src|href)="/[^/]' "$SITE/index.html"; then
   echo "error: $SITE/index.html has root-absolute URLs; it would break when served from a sub-path" >&2
diff --git a/sonar-project.properties b/sonar-project.properties
new file mode 100644
index 000000000..0e9e4fa3b
--- /dev/null
+++ b/sonar-project.properties
@@ -0,0 +1,2 @@
+sonar.projectKey=storytold_cadcraft
+sonar.organization=storytold
diff --git a/xtask/Cargo.toml b/xtask/Cargo.toml
index df7dfa877..701013cdc 100644
--- a/xtask/Cargo.toml
+++ b/xtask/Cargo.toml
@@ -7,3 +7,4 @@ publish = false
 
 [dependencies]
 serde_json = { workspace = true }
+chrono = { workspace = true }
diff --git a/xtask/src/main.rs b/xtask/src/main.rs
index c72bc0767..d5ef7dcab 100644
--- a/xtask/src/main.rs
+++ b/xtask/src/main.rs
@@ -20,7 +20,9 @@ commands:
   assets          check that every icon/image/font/asset is attributed in ATTRIBUTION.md
   layers          enforce the crate dependency layering (plan/architecture.md §3)
   wasm            cargo check --target wasm32-unknown-unknown for the wasm-safe crates
-  ci              fmt --check, clippy -D warnings, test, assets, layers, wasm (stops at first failure)
+  test            cargo nextest run (cargo test without nextest) plus the doctests
+  i18n            print the strings each interface language shows in English (never fails)
+  ci              fmt --check, clippy -D warnings, test, i18n, assets, layers, wasm (stops at first failure)
   corpus [--download]
                   show where test corpora live; --download fetches PngSuite into corpus/pngsuite
   stats [--exact] count tests and lines per crate (--exact: ask the test harness via `-- --list`)
@@ -36,6 +38,8 @@ fn main() -> ExitCode {
         Some("assets") => assets::run(&root()),
         Some("layers") => cmd_layers(),
         Some("wasm") => cmd_wasm(),
+        Some("test") => cmd_test(),
+        Some("i18n") => cmd_i18n(),
         Some("ci") => cmd_ci(),
         Some("corpus") => cmd_corpus(rest.contains(&"--download")),
         Some("stats") => stats::run(&root(), rest.contains(&"--exact")),
@@ -133,19 +137,48 @@ fn wasm_set() -> Result<Vec<String>, String> {
 
 fn cmd_wasm() -> Result<(), String> {
     let set = wasm_set()?;
-    let mut results = Vec::new();
+    let mut c = cargo();
+    c.args(["check", "--target", "wasm32-unknown-unknown", "--keep-going"]);
     for pkg in &set {
-        let mut c = cargo();
-        c.args(["check", "--target", "wasm32-unknown-unknown", "-p", pkg]);
-        let ok = run(c, &format!("cargo check --target wasm32-unknown-unknown -p {pkg}")).is_ok();
-        results.push((pkg.clone(), ok));
+        c.args(["-p", pkg]);
     }
-    println!("\nwasm32-unknown-unknown check:");
-    for (p, ok) in &results {
-        println!("  {:<6} {p}", if *ok { "ok" } else { "FAIL" });
+    run(c, &format!("cargo check --target wasm32-unknown-unknown --keep-going ({} crates)", set.len())).map_err(|e| format!("wasm check failed: {e}"))
+}
+
+/// Whether `cargo nextest` is installed.
+fn has_nextest() -> bool {
+    let mut c = cargo();
+    c.args(["nextest", "--version"]).stdout(std::process::Stdio::null()).stderr(std::process::Stdio::null());
+    c.status().is_ok_and(|s| s.success())
+}
+
+/// Unit and integration tests (examples are not built) with nextest, or `cargo test` when
+/// nextest is missing, then the doctests, which nextest does not run.
+fn cmd_test() -> Result<(), String> {
+    let mut c = cargo();
+    if has_nextest() {
+        c.args(["nextest", "run", "--workspace", "--lib", "--bins", "--tests"]);
+        run(c, "cargo nextest run --workspace --lib --bins --tests")?;
+    } else {
+        eprintln!("note: cargo-nextest is not installed (cargo install cargo-nextest --locked); running cargo test");
+        c.args(["test", "--workspace", "--lib", "--bins", "--tests"]);
+        run(c, "cargo test --workspace --lib --bins --tests")?;
     }
-    let failed = results.iter().filter(|r| !r.1).count();
-    if failed == 0 { Ok(()) } else { Err(format!("{failed} crate(s) failed the wasm check")) }
+    let mut c = cargo();
+    c.args(["test", "--workspace", "--doc"]);
+    run(c, "cargo test --workspace --doc")
+}
+
+/// The translation gap report (`cadcraft-ui-egui`'s ignored `i18n::tests::translation_gaps`).
+/// A missing translation shows in English and never fails a build, so neither does this step.
+fn cmd_i18n() -> Result<(), String> {
+    let mut c = cargo();
+    // `--workspace` builds the same test binaries as the test step; `-p` alone would rebuild them.
+    c.args(["test", "--workspace", "--lib", "-q", "--", "--ignored", "--exact", "i18n::tests::translation_gaps", "--nocapture"]);
+    if let Err(e) = run(c, "cargo test --workspace --lib -q -- --ignored --exact i18n::tests::translation_gaps --nocapture") {
+        eprintln!("note: the translation gap report did not run: {e}");
+    }
+    Ok(())
 }
 
 fn cmd_ci() -> Result<(), String> {
@@ -163,18 +196,12 @@ fn cmd_ci() -> Result<(), String> {
             "clippy",
             Box::new(|| {
                 let mut c = cargo();
-                c.args(["clippy", "--workspace", "--all-targets", "--", "-D", "warnings"]);
-                run(c, "cargo clippy --workspace --all-targets -- -D warnings")
-            }),
-        ),
-        (
-            "test",
-            Box::new(|| {
-                let mut c = cargo();
-                c.args(["test", "--workspace"]);
-                run(c, "cargo test --workspace")
+                c.args(["clippy", "--workspace", "--all-targets", "--keep-going", "--", "-D", "warnings"]);
+                run(c, "cargo clippy --workspace --all-targets --keep-going -- -D warnings")
             }),
         ),
+        ("test", Box::new(cmd_test)),
+        ("i18n", Box::new(cmd_i18n)),
         ("assets", Box::new(|| assets::run(&root()))),
         ("layers", Box::new(cmd_layers)),
         ("wasm", Box::new(cmd_wasm)),
diff --git a/xtask/src/parity.rs b/xtask/src/parity.rs
index 6adee8bdb..39f8e8713 100644
--- a/xtask/src/parity.rs
+++ b/xtask/src/parity.rs
@@ -28,25 +28,39 @@ pub fn leaves(catalog: &str) -> Vec<String> {
 /// Where the generated checklist goes.
 pub const OUT: &str = "docs/parity-checklist.md";
 
-/// Today's UTC date as `YYYY-MM-DD` (from the system clock; no date crate needed).
+/// Today's UTC date as `YYYY-MM-DD` (from the system clock).
 fn today() -> String {
-    let secs = std::time::SystemTime::now().duration_since(std::time::UNIX_EPOCH).map(|d| d.as_secs()).unwrap_or(0);
-    let (y, m, d) = civil_from_days((secs / 86_400) as i64);
+    date(std::time::SystemTime::now())
+}
+
+/// `t` as a UTC `YYYY-MM-DD`. A clock before 1970 reads as 1970-01-01 (the `unwrap_or(0)` clamp);
+/// past chrono's year 262143 range the proleptic Gregorian date is kept via the 400-year cycle
+/// rather than falling back to the epoch.
+fn date(t: std::time::SystemTime) -> String {
+    let secs = t.duration_since(std::time::UNIX_EPOCH).map(|d| d.as_secs()).unwrap_or(0);
+    let (y, m, d) = civil_from_days(secs / 86_400);
+    // `{y:04}` rather than `%Y`, which writes a `+` before years past 9999.
     format!("{y:04}-{m:02}-{d:02}")
 }
 
-/// Days since 1970-01-01 → (year, month, day) in the proleptic Gregorian calendar.
-fn civil_from_days(z: i64) -> (i64, u32, u32) {
-    let z = z + 719_468;
-    let era = z.div_euclid(146_097);
-    let doe = z.rem_euclid(146_097);
-    let yoe = (doe - doe / 1_460 + doe / 36_524 - doe / 146_096) / 365;
-    let doy = doe - (365 * yoe + yoe / 4 - yoe / 100);
-    let mp = (5 * doy + 2) / 153;
-    let d = (doy - (153 * mp + 2) / 5 + 1) as u32;
-    let m = if mp < 10 { mp + 3 } else { mp - 9 } as u32;
-    let y = yoe + era * 400 + i64::from(m <= 2);
-    (y, m, d)
+/// Days since 1970-01-01 → proleptic Gregorian (year, month, day).
+///
+/// `date` clamps a pre-1970 clock to the epoch, so `days` is an unsigned count that can run past
+/// `NaiveDate`'s ±262143-year range. The Gregorian calendar repeats every 400 years (146_097
+/// days), so chrono converts the day within one cycle and whole cycles go back into the year (an
+/// `i128`, then saturated into `i64`), keeping chrono as the only calendar logic and reproducing
+/// the old `civil_from_days` result exactly. 1970-01-01 is `num_days_from_ce` 719_163.
+fn civil_from_days(days: u64) -> (i64, u32, u32) {
+    use chrono::Datelike;
+    let (cycles, rest) = (days / 146_097, days % 146_097);
+    // `rest + 719_163` is 719_163..865_259, always a valid CE day.
+    match i32::try_from(rest + 719_163).ok().and_then(chrono::NaiveDate::from_num_days_from_ce_opt) {
+        Some(d) => {
+            let y = i128::from(d.year()) + i128::from(cycles) * 400;
+            (i64::try_from(y).unwrap_or(i64::MAX), d.month(), d.day())
+        }
+        None => (1970, 1, 1), // unreachable
+    }
 }
 
 pub fn run(root: &Path) -> Result<(), String> {
@@ -116,9 +130,17 @@ mod tests {
 
     #[test]
     fn civil_dates() {
-        assert_eq!(civil_from_days(0), (1970, 1, 1));
-        assert_eq!(civil_from_days(11_016), (2000, 2, 29));
-        assert_eq!(civil_from_days(20_736), (2026, 10, 10));
+        let day = |d: u64| date(std::time::UNIX_EPOCH + std::time::Duration::from_secs(d * 86_400));
+        assert_eq!(day(0), "1970-01-01");
+        assert_eq!(day(11_016), "2000-02-29");
+        assert_eq!(day(20_736), "2026-10-10");
+        assert_eq!(date(std::time::UNIX_EPOCH - std::time::Duration::from_secs(86_400)), "1970-01-01");
+        // Past chrono's range keeps the proleptic Gregorian date, not the epoch (old `civil_from_days`).
+        assert_eq!(day(115_740_740), "318857-05-20");
+        // Windows' SystemTime can't hold u64::MAX / 2 seconds, so it is only checked where it exists.
+        if let Some(far) = std::time::UNIX_EPOCH.checked_add(std::time::Duration::from_secs(u64::MAX / 2)) {
+            assert_eq!(date(far), "292277026596-12-04");
+        }
     }
 
     #[test]
diff --git a/xtask/src/stats.rs b/xtask/src/stats.rs
index f40b1300a..c2c6de3d2 100644
--- a/xtask/src/stats.rs
+++ b/xtask/src/stats.rs
@@ -10,20 +10,44 @@ struct Counts {
     proptests: usize,
 }
 
-fn walk(dir: &Path, c: &mut Counts) {
+/// Upper bound on directory entries visited in one `walk`, so even a crafted tree of aliases can
+/// never make the stats command run unbounded work.
+const MAX_ENTRIES: usize = 2_000_000;
+
+/// Accumulate Rust source counts under one directory with a fresh traversal-entry budget.
+fn walk(dir: &Path, c: &mut Counts) -> Result<(), String> {
+    let mut budget = MAX_ENTRIES;
+    walk_inner(dir, c, &mut budget)
+}
+
+/// Traverse entries without following symlinks, sharing one budget across descendant directories.
+/// Skip unreadable entries and excluded directories; report budget exhaustion to the caller.
+fn walk_inner(dir: &Path, c: &mut Counts, budget: &mut usize) -> Result<(), String> {
     let Ok(rd) = std::fs::read_dir(dir) else {
-        return;
+        return Ok(());
     };
     for e in rd.flatten() {
+        if *budget == 0 {
+            return Err(format!("stats traversal budget exhausted at {}", dir.display()));
+        }
+        *budget -= 1;
+        // Use the entry's own type and never follow symlinks: a directory symlink would otherwise
+        // be re-scanned as a fresh directory, so a small graph of aliases could cause exponential
+        // repeated enumeration and reads (CWE-400).
+        let Ok(ft) = e.file_type() else { continue };
+        if ft.is_symlink() {
+            continue;
+        }
         let p = e.path();
         let name = e.file_name();
         let name = name.to_string_lossy();
-        if p.is_dir() {
+        if ft.is_dir() {
             // Nested fuzz workspaces and build output are not part of the crate.
             if name != "target" && name != "fuzz" && !name.starts_with('.') {
-                walk(&p, c);
+                walk_inner(&p, c, budget)?;
             }
-        } else if name.ends_with(".rs")
+        } else if ft.is_file()
+            && name.ends_with(".rs")
             && let Ok(s) = std::fs::read_to_string(&p)
         {
             c.files += 1;
@@ -33,6 +57,7 @@ fn walk(dir: &Path, c: &mut Counts) {
             c.proptests += pt;
         }
     }
+    Ok(())
 }
 
 /// `#[test]` attributes and `proptest!` blocks (each block may hold many
@@ -62,6 +87,7 @@ fn exact_tests(pkg: &str) -> Option<usize> {
     Some(String::from_utf8_lossy(&out.stdout).lines().filter(|l| l.ends_with(": test")).count())
 }
 
+/// Print per-package source statistics, optionally querying exact test counts, and propagate traversal errors.
 pub fn run(_root: &Path, exact: bool) -> Result<(), String> {
     let meta = crate::metadata()?;
     let mut rows = Vec::new();
@@ -71,7 +97,7 @@ pub fn run(_root: &Path, exact: bool) -> Result<(), String> {
             continue;
         };
         let mut c = Counts::default();
-        walk(&dir, &mut c);
+        walk(&dir, &mut c)?;
         let ex = if exact { exact_tests(&name) } else { None };
         rows.push((name, c, ex));
     }
@@ -108,11 +134,42 @@ pub fn run(_root: &Path, exact: bool) -> Result<(), String> {
 
 #[cfg(test)]
 mod tests {
-    use super::count_tests;
+    use super::{Counts, count_tests, walk};
 
     #[test]
     fn counts_attributes_and_proptest_blocks() {
         let src = "#[test]\nfn a() {}\n// #[test] commented\n    #[test]\nfn b() {}\nproptest! {\n}\n";
         assert_eq!(count_tests(src), (2, 1));
     }
+
+    /// A directory alias does not cause its Rust source to be counted twice.
+    #[cfg(unix)]
+    #[test]
+    fn walk_does_not_follow_directory_symlinks() {
+        use std::os::unix::fs::symlink;
+        let base = std::env::temp_dir().join(format!("cadcraft-xtask-{}", std::process::id()));
+        let _ = std::fs::remove_dir_all(&base);
+        let real = base.join("real");
+        std::fs::create_dir_all(&real).unwrap();
+        std::fs::write(real.join("a.rs"), "fn a() {}\n").unwrap();
+        // A directory symlink pointing back at `real` would be re-scanned if followed.
+        symlink(&real, base.join("alias")).unwrap();
+        let mut c = Counts::default();
+        walk(&base, &mut c).unwrap();
+        assert_eq!(c.files, 1, "the aliased directory was followed and counted twice");
+        std::fs::remove_dir_all(&base).ok();
+    }
+    /// Traversal reports an exhausted entry budget and accepts a tree that exactly fits it.
+    #[test]
+    fn walk_reports_budget_exhaustion() {
+        let base = std::env::temp_dir().join(format!("cadcraft-stats-budget-{}", std::process::id()));
+        std::fs::create_dir_all(&base).unwrap();
+        std::fs::write(base.join("a.rs"), "fn a() {}\n").unwrap();
+        let error = super::walk_inner(&base, &mut Counts::default(), &mut 0).unwrap_err();
+        assert!(error.contains("budget exhausted"));
+        let mut c = Counts::default();
+        super::walk_inner(&base, &mut c, &mut 1).unwrap();
+        assert_eq!(c.files, 1);
+        std::fs::remove_dir_all(base).unwrap();
+    }
 }